How do you (not how do I) calculate 95th percentile?

Tom Sands tsands at
Wed Feb 22 22:18:08 UTC 2006

David W. Hankins wrote:

> On Wed, Feb 22, 2006 at 12:50:34PM -0600, Tom Sands wrote:
>>>A lot of smaller folks check the counter every 5 min and use that same
>>>value for the 95th percentile.  Most of us larger folks need to check more 
>>>often to prevent 32bit counters from rolling over too often. 
>>Actually, a lot of people do 5 minutes... and I would say that larger 
>>companies don't check them more often because they are using 64 bit 
>>counters, as should anyone with over about 100Mbps of traffic.
> Counter size is an incomplete reason for polling interval.

Possibly incomplete, but a reason for some none the less, if all they 
can do is 32 bit counters.

> If you need a 5 minute average and poll your routers once every five
> minutes, what happens if an SNMP packet gets lost?

No one said it was "needed", just what is done.. and I agree with  your 
reason of more frequent polling, than doing it because of counter roll.

> In the best case, a retransmission over Y seconds sees it through, but
> now you've got 300+Y seconds in what was supposed to be a 300 second
> average...your next datapoint will also now be a 300-Y average unless
> you schedule it into the future.
> In the worst case, you've lost the datapoint entirely.  This loses not
> just the one datapoint ending in that five minute span, but also the
> next datapoint.  Sure, you can synthesize two 5 minute averages from
> one 10 minute average (presuming your counters wouldn't roll), but this
> is still a loss in data - one of those two datapoints should have been
> higher than the other.

>>In our setup, as with a lot of people likely, any data that is older 
>>than 30 days is averaged.  However, we store the exact maximums for the 
>>most current 30 days.
> You keep no record?  What do you do if a customer challenges their
> bill?  Synthesize 5 minute datapoints out of the larger averages?

This isn't for customer billing.  We don't bill customers on Mbps, but 
rather on total volume of GB transfered.  That is an easy number to 
collect and doesn't depend on 5 minute itervals being successful.  Right 
up until someone clears the counters  ;)

> I recommend keeping the 5 minute averages in perpetuity, even if that
> means having an operator burn the data to CD and store it in a safe (not
> under his desk in the pizza boxes, nor under his soft drink as a coaster).

Tom Sands			  				
Chief Network Engineer				
Rackspace Managed Hosting	    	

More information about the NANOG mailing list