Netflix Streaming — how ~250M subscribers watch ~1B hours a day

Netflix streams roughly a billion hours of video every day. At peak hours, that's ~15% of global downstream internet traffic. The engineering problem is not "how do we serve videos" — it's how do we serve videos without owning the internet. The answer is to move most of the bytes as close to the viewer as possible, own the encoding and control planes centrally, and assume every layer will eventually fail.

Netflix pre-encodes every title into a ladder of bitrates (typically 10–15 renditions from ~200 kbps up to 4K HDR). The player continuously measures buffer health and network throughput and picks the highest rendition it can sustain. If the network drops, the player steps down a rung and refills; if it recovers, it steps up.

The engineering wins: (a) per-title encoding — using signal analysis to pick the best ladder for each title, rather than a one-size-fits-all encoding, saves 20-30% bitrate at the same quality; (b) buffer-based selection (BBA) rather than throughput-based selection avoids over-reacting to short spikes.

Netflix ships free servers to ISPs. Each server holds the most popular titles for that ISP's viewers. When a viewer requests a stream, DNS steers them to a nearby Open Connect appliance (OCA); only the ~5% of misses reach AWS. This is why Netflix runs at hyperscale bandwidth without hyperscale bandwidth bills.

Content is proactively warmed during off-peak hours: Netflix predicts what viewers in each region will watch and pushes those bytes to the local OCA overnight. Streaming at peak hours is then a read from local SSD, not a request across the WAN.

Netflix invented the discipline. Chaos Monkey randomly kills instances in production. Chaos Kong kills an entire AWS region. This forces every service to be built resilient by default — because if it isn't, an SRE gets paged that afternoon.

The philosophical shift: reliability is not a property you add after; it's something you continuously prove.

The control plane (auth, entitlements, recommendations, playback state) runs active-active across three AWS regions. Each region can serve every user. State is replicated via Cassandra + DynamoDB global tables. If a region fails, Zuul (Netflix's edge routing layer) reroutes within seconds; users at worst see a paused stream that resumes automatically.

Open Connect appliances cost Netflix hardware + shipping + a small ISP subsidy, versus commercial CDN bandwidth at ~$0.02/GB. At Netflix's scale — 200+ Tbps peak — commercial CDN would cost billions annually. Open Connect pays for itself in months.

The control plane running active-active adds cost overhead (~3× the capacity of a single-region variant). Netflix accepts this because the cost of downtime — measured in cancellations — is higher.