# How can I calculate the 95-percentile bandwidth usage of a network device?

My provider is billing my bandwidth using the 95-percentile method. I know what it is in principle (take measurements, throw the top 5% away and use the remaining highest as result).

The question here is what is used as base data!

It is my understanding that with my current provider the switch logs the traffic per 5-minute interval. Not a single measurement every 5 minutes but the 5 minute average!

Is interval standardized or at least a de-facto standard in the industry? Is it also standard to use the average bandwith (wich equals data devided by time) during those intervals or just take for example a 5 sec average every 5 minutes?

My second question is: Is there an application, like vnstat, which I can use to measure the 95-percentile myself?

-

The standard I Know is simply to look at the network counters (Transmitted packets / bytes) per 5 minutes. Simple as that - this give you average as you dont know how that was distributed over the 5 minutes.

Basically measure bytes / packets sent / received counters from network equipment every 5 minutes. That is 100%. Throw away the 5% highest numbers, that is the 95% percentile.

Measuring yourself - yes, but getting exactly the same numbers is hard (need to measure the same elements exactly at same time).

-
thanks :) ........ – The Shurrican Feb 11 '13 at 11:14

There were patches around that added 95th percentile graphing to MRTG, but they were not accepted in upstream source and probably never will.

You have to "upgrade" to rrdtool, by the same author, which does 95th percentile but usually involves more work to set up. The advantage here is that rrdtool is much more flexible than mrtg and you can do many other things with it.

If you want to set up a more complete monitoring and graphing solution, Cacti and friends all have templates for network traffic that include 95th percentile.

-

Do you have any router/firewall devices in your setup, or are you just connecting from a Linux host? (that makes a difference in your monitoring options)

Your provider should provide you a running graph (usually some RRDtool derivative and/or MRTG) displaying your bandwidth utilization throughout the course of the billing cycle. They can measure from your uplink port.

I use Observium on my side, but that's for a larger installation. I'll tap the outside interface of my edge device and monitor 95th-Percentile there. The tool is meant to be used by service providers, so the billing templates are all present.

Something like:

I receive the following breakdown (with a projection) every month from one of my providers...

``````--------------------------------
Transit : Bandwidth Usage Breakdown
--------------------------------
Last Month Usage Breakdown:

From: Tue Jan  1 00:00:00 CST 2013
To: Fri Feb  1 00:00:00 CST 2013

GBytes     IN =   184.661
GBytes    OUT =   944.873
-----------------
TOTAL =  1129.534

95th Percentile:  9.866 Mbps

--------------------------------
Month-To-Date Usage Breakdown:

From: Fri Feb  1 00:00:00 CST 2013
To: Mon Feb 11 07:33:37 CST 2013

GBytes     IN =    60.902
GBytes    OUT =   287.265
-----------------
TOTAL =   348.168

95th Percentile:  9.906 Mbps

--------------------------------
Current Month Projection Usage Breakdown:

From: Fri Feb  1 00:00:00 CST 2013
To: Fri Mar  1 00:00:00 CST 2013

GBytes     IN =    60.902
GBytes    OUT =   287.265
-----------------
TOTAL =   348.168

95th Percentile:  9.412 Mbps

--------------------------------
``````
-

If you are on linux, `ifconfig` gives you some hints. Run a script to get the data at 5 minute interval and then manually chop off the top 5% data and done.

On a micro level, you might check `ethtool -S ethX` where you get detail packet statistics. Again, put in a script at 5 minute interval, calculate for a day or two and then run some measurements on it. Insert the date command after each iteration of main command to get an estimate of when you are measuring and when your provider is measuring.

-