Home page logo

nanog logo nanog mailing list archives

Re: How do you (not how do I) calculate 95th percentile?
From: Tom Sands <tsands () rackspace com>
Date: Wed, 22 Feb 2006 16:18:08 -0600

David W. Hankins wrote:

On Wed, Feb 22, 2006 at 12:50:34PM -0600, Tom Sands wrote:

A lot of smaller folks check the counter every 5 min and use that same
value for the 95th percentile. Most of us larger folks need to check more often to prevent 32bit counters from rolling over too often.

Actually, a lot of people do 5 minutes... and I would say that larger companies don't check them more often because they are using 64 bit counters, as should anyone with over about 100Mbps of traffic.

Counter size is an incomplete reason for polling interval.

Possibly incomplete, but a reason for some none the less, if all they can do is 32 bit counters.

If you need a 5 minute average and poll your routers once every five
minutes, what happens if an SNMP packet gets lost?

No one said it was "needed", just what is done.. and I agree with your reason of more frequent polling, than doing it because of counter roll.

In the best case, a retransmission over Y seconds sees it through, but
now you've got 300+Y seconds in what was supposed to be a 300 second
average...your next datapoint will also now be a 300-Y average unless
you schedule it into the future.

In the worst case, you've lost the datapoint entirely.  This loses not
just the one datapoint ending in that five minute span, but also the
next datapoint.  Sure, you can synthesize two 5 minute averages from
one 10 minute average (presuming your counters wouldn't roll), but this
is still a loss in data - one of those two datapoints should have been
higher than the other.

In our setup, as with a lot of people likely, any data that is older than 30 days is averaged. However, we store the exact maximums for the most current 30 days.

You keep no record?  What do you do if a customer challenges their
bill?  Synthesize 5 minute datapoints out of the larger averages?

This isn't for customer billing. We don't bill customers on Mbps, but rather on total volume of GB transfered. That is an easy number to collect and doesn't depend on 5 minute itervals being successful. Right up until someone clears the counters ;)

I recommend keeping the 5 minute averages in perpetuity, even if that
means having an operator burn the data to CD and store it in a safe (not
under his desk in the pizza boxes, nor under his soft drink as a coaster).

Tom Sands                                                       
Chief Network Engineer                          
Rackspace Managed Hosting               

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]