Chapter 13 — Traffic Direction: SLI & SLO
In this chapter, SLI and SLO mean Site Local In and Site Local Out: traffic direction relative to a site or datacenter. This is different from the SRE meanings, Service Level Indicator and Service Level Objective. The acronym collision is real; define the terms before using them in mixed networking/SRE conversations.
Looking for SLIs and SLOs in the SRE sense (Service Level Indicators, Objectives, error budgets, and burn-rate alerts)? They're in Chapter 23, with a Go simulation of 30 days of traffic that shows which incidents should page and which should only open a ticket.
The Simple Version (5-year-old)
Imagine a busy airport. Planes are either:
- Landing (arriving from outside) — that's SLI: Site Local In
- Taking off (leaving to the outside) — that's SLO: Site Local Out
The airport control tower (Netflix's network team) monitors both: how many planes are landing and taking off on each runway (network link), and can re-route flights if one runway is too busy.
SLI — Site Local In
SLI (Site Local In) is inbound traffic entering a site or datacenter — packets arriving from the outside world (the internet) destined for servers inside.
In the Netflix Lifecycle
When you send your HTTP request:
Internet (you)
│
▼ ◄── This is SLI: Site Local In
Netflix Datacenter / Edge boundary
(border router ingress interface)
│
▼
Internal servers (10.0.x.x)
Your GET request, TCP SYN packets, TLS ClientHello, HTTP headers — all of this is SLI traffic from Netflix's perspective.
What Netflix Monitors on SLI
Border Router Interface: xe-0/0/0 (facing Comcast peering)
Direction: IN (ingress)
Real-time counters:
Bytes/second in: ~120 Gbps (HTTP requests, TCP ACKs, video player pings)
Packets/sec in: ~90 Mpps (millions of packets per second)
Flows/sec in: ~500K (new TCP connections per second)
SYN rate in: ~400K/s (monitored for SYN flood DDoS)
Avg pkt size in: ~200 bytes (small — requests and ACKs are small)
SLI and Security
SLI is where DDoS attacks arrive. Netflix monitors SLI for:
Normal SLI: 100 Gbps inbound, mix of TCP ports 443 (HTTPS), 80 (HTTP redirect)
DDoS signal: 800 Gbps inbound, all UDP port 53 (amplification), from 50K source IPs
Action:
→ Black-hole routing: DROP all traffic matching attack signature at border router
→ Scrubbing center: route SLI traffic through DDoS scrubber, clean traffic forwarded in
→ BGP community: signal upstream ISPs to drop attack traffic before it enters Netflix's network
Firewall ACLs act on SLI:
ALLOW TCP dest-port 443 (HTTPS — your request)
ALLOW TCP dest-port 80 (HTTP — redirect to HTTPS)
ALLOW ICMP (ping, traceroute — diagnostics)
DENY TCP dest-port 22 (SSH — block external SSH to internal servers)
DENY all other
SLO — Site Local Out
SLO (Site Local Out) is outbound traffic leaving a site or datacenter — packets originating inside Netflix's network going out to the internet.
In the Netflix Lifecycle
When Netflix sends your HTTP response:
Internal servers (10.0.x.x)
│
▼ ◄── This is SLO: Site Local Out
Netflix Datacenter / Edge boundary
(border router egress interface)
│
▼
Internet (back to you)
The HTML response, video chunks, TLS ServerHello, image bytes — all SLO traffic.
What Netflix Monitors on SLO
Border Router Interface: xe-0/0/0 (facing Comcast peering)
Direction: OUT (egress)
Real-time counters:
Bytes/second out: ~380 Gbps (HTML, video chunks, images, API responses)
Packets/sec out: ~280 Mpps
BGP advertisements: which prefixes are being announced outbound
Per-peer egress breakdown: how much traffic goes to each ISP peer
Avg pkt size out: ~1400 bytes (close to MTU — video chunks fill packets)
The Asymmetry — Why SLO is Always Much Larger Than SLI
SLI (your request):
GET / HTTP/2
+ headers: ~2KB total
SLO (Netflix response):
HTML: 45KB (compressed)
CSS: 150KB
JavaScript: 500KB
Images: 2MB
Video (1 min of HD): ~150MB
Ratio: SLO is typically 3–50× larger than SLI for a media platform.
Netflix border router (Comcast peering link):
SLI: 120 Gbps in
SLO: 380 Gbps out
Ratio: ~1:3 (requests vs responses)
SLI + SLO in Traffic Engineering
Netflix has peering relationships with hundreds of ISPs. They can shift traffic between peers based on cost, performance, and capacity.
Peering Link View
Netflix has four peering links (simplified):
Interface Peer SLI (in) SLO (out) Cost/Gbps
xe-0/0/0 Comcast 120 Gbps 380 Gbps $0 (free peer)
xe-0/0/1 AT&T 90 Gbps 270 Gbps $0 (free peer)
xe-0/0/2 Tata 40 Gbps 120 Gbps $0 (free peer - OCA)
xe-0/0/3 NTT Transit 50 Gbps 150 Gbps $2/Gbps (paid transit)
Total SLI: 300 Gbps
Total SLO: 920 Gbps
Why Netflix Moves Traffic Between Peers
Scenario: Comcast xe-0/0/0 SLO reaches 95% capacity (380/400 Gbps).
Traffic engineering action:
1. Reduce BGP LOCAL_PREF for Comcast-bound routes
(makes other paths look more attractive to BGP)
2. BGP re-routes some Comcast users to AT&T or Tata peers
3. SLO on Comcast drops to 320 Gbps
4. SLO on AT&T rises to 330 Gbps
5. Both links are now safely within capacity
This is done without any user-visible disruption.
BGP convergence: ~5 seconds for internal routes.
95th Percentile Billing (Burstable Billing)
Most transit providers charge based on the 95th percentile of either SLO or (SLI + SLO), sampled every 5 minutes over a month:
5-minute SLO samples over a month:
[5, 8, 12, 400, 380, 370, 350, 200, 50, 10, ...] Gbps
Sort all samples ascending.
95th percentile = top 5% excluded (the spikes).
You pay for the 95th percentile value.
Why this model:
Allows burst to 100% capacity occasionally without paying for that peak.
Pay for sustained capacity, not momentary bursts.
Netflix engineers to keep 95th percentile under contracted rate to avoid overage charges.
SLI vs SLO in Firewall Policy
Stateful firewalls track the direction of traffic initiation:
Stateful firewall rule:
ALLOW: TCP SLI from 0.0.0.0/0 to 10.0.4.0/24 port 443 (inbound HTTPS)
→ Creates a connection state table entry
ALLOW: TCP SLO from 10.0.4.0/24 to 0.0.0.0/0 ESTABLISHED
→ Return traffic for SLI-initiated connections automatically allowed
DENY: TCP SLI from 0.0.0.0/0 to 10.0.4.0/24 port 22
→ External SSH blocked
Result:
Your GET request → SLI → ALLOWED (port 443)
Netflix's response → SLO → ALLOWED (ESTABLISHED - return traffic)
Attacker SSH attempt → SLI port 22 → DENIED
SLI/SLO and Netflix Open Connect OCA
A key goal of OCA placement is converting expensive long-haul SLO into cheap/free local SLO:
WITHOUT OCA (all SLO from Netflix HQ):
Netflix HQ → Internet → Tata Mumbai → User in Mumbai
SLO travels: US → Mumbai (expensive transit)
Tata pays Netflix for transit. Netflix pays NTT for transit. $$$$
WITH OCA at Tata Mumbai:
OCA Mumbai → [Tata's internal network] → User in Mumbai
SLO stays inside Tata's network instead of crossing paid transit links.
No transit cost. Netflix gives OCA to Tata for free.
Tata benefits: doesn't pay transit fees for Netflix video.
Netflix benefits: zero SLO transit cost for ~95% of video.
Global SLO reduction:
Netflix total SLO: ~600 Gbps
Via OCA (no transit cost): ~570 Gbps (95%)
Via origin (transit cost): ~30 Gbps (5%)
Summary Table
| Concept | SLI (Site Local In) | SLO (Site Local Out) |
|---|---|---|
| Direction | Internet → Datacenter | Datacenter → Internet |
| What it is | Inbound traffic | Outbound traffic |
| Netflix example | Your HTTP request | Netflix's HTTP response + video |
| Typical volume | Smaller | Larger (3–50×) |
| DDoS concern | Yes — attacks arrive via SLI | DDoS amplification can exit via SLO |
| Firewall role | Ingress filtering — block attacks | Egress shaping — prevent saturation |
| Billing impact | Often not billed (or small) | Usually billed (95th percentile egress) |
| Traffic engineering | Adjust BGP LOCAL_PREF | Shift egress between peers |
| OCA impact | No change | Converts transit SLO to free local delivery |
Key Takeaways
- SLI (Site Local In) = inbound traffic entering a datacenter. Your requests. TCP SYNs. TLS ClientHellos.
- SLO (Site Local Out) = outbound traffic leaving a datacenter. Netflix's responses. Video chunks. Images.
- SLO is usually much larger than SLI for media platforms because responses massively outweigh requests.
- BGP traffic engineering shifts SLO across peering links to balance cost and capacity.
- Firewall policies distinguish SLI-initiated (allowed by rule) from SLO-returned (allowed as ESTABLISHED).
- 95th percentile billing means you pay for sustained egress, not momentary spikes.
- Netflix OCA's core purpose is to convert expensive transit SLO into free local delivery.
- Monitoring SLI for sudden spikes detects DDoS attacks. Monitoring SLO for capacity triggers traffic shifts.