How can I calculate the 95-percentile bandwidth usage of a network device?

Question

My provider is billing my bandwidth using the 95-percentile method. I know what it is in principle (take measurements, throw the top 5% away and use the remaining highest as result).

The question here is what is used as base data!

It is my understanding that with my current provider the switch logs the traffic per 5-minute interval. Not a single measurement every 5 minutes but the 5 minute average!

Is interval standardized or at least a de-facto standard in the industry? Is it also standard to use the average bandwith (wich equals data devided by time) during those intervals or just take for example a 5 sec average every 5 minutes?

My second question is: Is there an application, like vnstat, which I can use to measure the 95-percentile myself?

score 3 · Accepted Answer · answered Feb 11 '13 at 11:10

The standard I Know is simply to look at the network counters (Transmitted packets / bytes) per 5 minutes. Simple as that - this give you average as you dont know how that was distributed over the 5 minutes.

Basically measure bytes / packets sent / received counters from network equipment every 5 minutes. That is 100%. Throw away the 5% highest numbers, that is the 95% percentile.

Measuring yourself - yes, but getting exactly the same numbers is hard (need to measure the same elements exactly at same time).

ewwhite · Answer 2 · 2013-02-11T14:19:31.990

Do you have any router/firewall devices in your setup, or are you just connecting from a Linux host? (that makes a difference in your monitoring options)

Also what your committed rate right now versus your burstable rate?

Your provider should provide you a running graph (usually some RRDtool derivative and/or MRTG) displaying your bandwidth utilization throughout the course of the billing cycle. They can measure from your uplink port.

I use Observium on my side, but that's for a larger installation. I'll tap the outside interface of my edge device and monitor 95th-Percentile there. The tool is meant to be used by service providers, so the billing templates are all present.

Something like:

enter image description here

I receive the following breakdown (with a projection) every month from one of my providers...

--------------------------------
Transit : Bandwidth Usage Breakdown
--------------------------------
Last Month Usage Breakdown:

       From: Tue Jan  1 00:00:00 CST 2013
         To: Fri Feb  1 00:00:00 CST 2013

  GBytes     IN =   184.661
  GBytes    OUT =   944.873
          -----------------
          TOTAL =  1129.534

  95th Percentile:  9.866 Mbps

--------------------------------
Month-To-Date Usage Breakdown:

       From: Fri Feb  1 00:00:00 CST 2013
         To: Mon Feb 11 07:33:37 CST 2013

  GBytes     IN =    60.902
  GBytes    OUT =   287.265
          -----------------
          TOTAL =   348.168

  95th Percentile:  9.906 Mbps

--------------------------------
Current Month Projection Usage Breakdown:

       From: Fri Feb  1 00:00:00 CST 2013
         To: Fri Mar  1 00:00:00 CST 2013

  GBytes     IN =    60.902
  GBytes    OUT =   287.265
          -----------------
          TOTAL =   348.168

  95th Percentile:  9.412 Mbps

--------------------------------

score 1 · Answer 3 · answered Feb 11 '13 at 11:15

If you are on linux, ifconfig gives you some hints. Run a script to get the data at 5 minute interval and then manually chop off the top 5% data and done.

On a micro level, you might check ethtool -S ethX where you get detail packet statistics. Again, put in a script at 5 minute interval, calculate for a day or two and then run some measurements on it. Insert the date command after each iteration of main command to get an estimate of when you are measuring and when your provider is measuring.

score 1 · Answer 4 · answered Feb 11 '13 at 13:48

There were patches around that added 95th percentile graphing to MRTG, but they were not accepted in upstream source and probably never will.

You have to "upgrade" to rrdtool, by the same author, which does 95th percentile but usually involves more work to set up. The advantage here is that rrdtool is much more flexible than mrtg and you can do many other things with it.

If you want to set up a more complete monitoring and graphing solution, Cacti and friends all have templates for network traffic that include 95th percentile.

score 0 · Answer 5 · answered Jun 18 '19 at 19:44

This should give you 95th percentile of an interface in Linux:

======= 95th.sh =====

#!/bin/bash

IFACE=${1-eth0}
INTERVAL=${2-10}
# Generate environment vars RX1,RX2 and TX1,TX2 which are 10 seconds apart:
eval $(
    ifconfig  $IFACE | grep '[RT]X packets' | awk '{print $1" "$5}' | sed 's/ /1=/' 
    sleep $INTERVAL
    ifconfig  $IFACE | grep '[RT]X packets' | awk '{print $1" "$5}' | sed 's/ /2=/') 

# Convert to kbit/sec:
let "RX=($RX2-$RX1)*8/$INTERVAL / 1000"
let "TX=($TX2-$TX1)*8/$INTERVAL / 1000"

# BX is the max of both:
let "BX = $TX > RX ? $TX : $RX"

echo $BX RX=$RX TX=$TX BX=$BX $(date '+%F %H:%M:%S')

==== /etc/crontab ====

*/5  *  *  *  * root /usr/local/bin/95th.sh eth0 >> /var/log/95th-percent.log

==== find the 95th percentile entry from your log in kbits ====

DATE=2019-06
PERCENTILE=95
grep $DATE /var/log/95th-percent.log | sort -nr | head -n $(( $( grep -c $DATE /var/log/95th-percent.log ) * (100-$PERCENTILE) / 100 )) | tail -1

How can I calculate the 95-percentile bandwidth usage of a network device?

5 Answers5

Linked