95th Percentile: How Are Five-Minute Samples Billed?
Sort samples, discard peaks, apply the direction rule and commit: a worked example plus a contract checklist for 95/5 billing.
With 95/5 billing, regular bandwidth samples from a billing period are sorted by size. The highest five per cent are excluded and the next-highest value is the 95th percentile. Only then is that value compared with the commit using the agreed direction rule. The sampling interval, measurement, direction, aggregation and rounding rules therefore matter just as much as the number on the invoice.
What the 95th percentile means – and what it does not
A percentile describes the distribution of samples. At the 95th percentile, 95 per cent of the values are at or below the threshold and five per cent are above it. It is not the monthly average, not the single maximum and not a statement that 95 per cent of transferred data volume is billed. Juniper therefore describes percentile, average, minimum and maximum as separate metrics and also identifies the applicable aggregation interval.
Juniper Networks: percentiles and aggregation intervals
Do not confuse it with the DDoS learning baseline
AS51202's statement that 95% of legitimate traffic forms the baseline for adaptive threshold learning expressly does not refer to the billing percentile. These are two different contexts. During an attack, learning pauses while filtering remains active.
A complete example with 20 samples
The shortened example below is explicitly illustrative. Twenty samples make the calculation visible because every value represents exactly five per cent of the sample set. A real monthly invoice contains far more samples and follows contractually defined rules.
| Rank | Samples | Treatment |
|---|---|---|
| 1 | 2,000 | top 5%: discard |
| 2 | 800 | 95th percentile |
| 3–5 | 700, 680, 650 | include |
| 6–10 | 620, 610, 600, 590, 580 | include |
| 11–15 | 570, 560, 550, 540, 530 | include |
| 16–20 | 520, 510, 500, 490, 480 | include |
- 1Collect every valid sample in the billing period; there are 20 here.
- 2Sort the values in descending order, regardless of when they occurred during the period.
- 3Five per cent of 20 is exactly one value. Discard the 2,000-Mbps peak.
- 4The next value, 800 Mbps, is the 95th percentile in this example.
- 5Only now apply the direction rule, commit and contractually agreed burst rate.
Illustrative result
With an assumed 600-Mbps commit, the difference from the 95th percentile would be 200 Mbps. Whether that difference is charged, and at what rate, is determined solely by the specific proposal. This is not an AS51202 invoice or a pricing promise.
What a 30-day month with five-minute samples changes
Uninterrupted five-minute intervals produce 8,640 samples over 30 days. Five per cent is 432 samples; after they are removed, the 433rd-highest value is the billing basis. Equinix documents this exact worked example for its own burstable-billing model. It explains the arithmetic but does not establish another provider's contract terms.
Equinix: burstable billing with five-minute samples
In this idealised 30-day case, the top five per cent represent 36 cumulative hours. They need not occur continuously: many short peaks can fill the same share as one sustained period. When high usage lasts longer, more high samples move below the cut-off and increase the 95th percentile. A 31-day month, partial month or incomplete sample set produces a different count, so the contract must define rounding and missing-data treatment.
Inbound and outbound traffic: four rules, different results
Ingress and egress form two sample series. A provider can derive the billing quantity from them in several ways. No particular choice follows from the term ‘95th percentile’ alone. The rule must appear in the proposal and be reproducible from the usage report.
| Rule | Calculation | Question to ask |
|---|---|---|
| Higher direction | Calculate P95 for ingress and egress separately; use the higher result | Does the report expose both series? |
| Sum of direction values | Calculate P95 for each direction; add the two results | Is addition explicitly agreed? |
| Per-interval sum | Add ingress and egress in each time window; calculate one P95 | Are concurrent samples combined? |
| Separate billing | Give each direction its own commit and price rules | Is there one commit or two? |
The sum of two separately calculated percentiles is generally not equal to the percentile of the concurrent sum. Peaks can occur in opposite directions at different times. Any independent calculation must therefore use the provider's exact rule and time windows.
Keep commit, port and burst usage separate
The commit is the minimum contracted bandwidth charge. Port speed is the technical ceiling of the handoff, not automatically the billing basis. If the value produced by all agreed rules is below the commit, the commit will commonly remain payable. If it is higher, the difference may be charged as burst usage—but only at the rate and under the formula agreed in the proposal.
A checking formula for a specific proposal
Billing basis = the greater of the commit and the contractually calculated 95th-percentile value. Burst quantity = the greater of zero and the billing basis minus the commit. This simple expression helps when reading a proposal; price tiers, minimum charges or other contract rules may extend it.
The measurement and contract must answer these questions together
- Measurement point: which port, logical interface or group is observed?
- Measurement: is each interval based on a counter delta, an average or another value, and in which units?
- Period: when does the billing month start and end, in which time zone, and how are partial months handled?
- Completeness: what happens to missing, duplicated or implausible samples, and how is the number of discarded values rounded?
- Direction: does the higher direction count, a sum or separate billing?
- Aggregation: are redundant ports, LAG members, sites, IPv4 and IPv6 combined or treated separately?
- Mitigation: is traffic measured before or after DDoS filtering, and how does the contract treat verified attack traffic?
- Evidence: are the time series, sample count, excluded values and final calculation available for review?
RFC 2330 is not a billing standard. It does, however, show why a metric must be described together with its method, measurement conditions and sources of error. The same principle applies to an auditable transit invoice: a percentage without a defined sample series is not reproducible.
RFC 2330: framework for IP performance metrics
Plan the commit from real time series
- 1Export several complete, representative months using the same intervals as the proposal.
- 2Recalculate the 95th percentile using the intended direction and aggregation rule exactly.
- 3Mark one-off events such as migrations, backups or attacks, but do not silently remove them from planning.
- 4Assess normal operation, expected growth and seasonal peaks separately; an average hides the distribution that determines P95.
- 5Compare the planned commit with port headroom and burst pricing, then reconcile the provider's first report with your own calculation.
What to include in a transit enquiry
For a reliable proposal, provide the site, required port speed, current commit, several monthly ingress and egress time series, expected growth and known exceptional loads. Ask explicitly about the sampling interval, direction rule, aggregation, burst rate and treatment of DDoS traffic. That makes the proposal technically and commercially reproducible instead of reducing the comparison to two commit prices.