# On the Distribution of Traffic Volumes in the Internet and its Implications

## TL;DR

This paper analyzes internet traffic volume distributions across various networks, finding that the log-normal distribution models traffic better than Gaussian or Weibull, with implications for capacity planning and pricing.

## Contribution

It demonstrates that the log-normal distribution outperforms Gaussian and Weibull models in fitting traffic volume data and shows its practical utility in capacity and pricing predictions.

## Key findings

- Log-normal distribution fits traffic data better than Gaussian.
- Weibull distribution performs better than Gaussian but worse than log-normal.
- Anomalous traces often due to outages or capacity limits.

## Abstract

Getting good statistical models of traffic on network links is a well-known, often-studied problem. A lot of attention has been given to correlation patterns and flow duration. The distribution of the amount of traffic per unit time is an equally important but less studied problem. We study a large number of traffic traces from many different networks including academic, commercial and residential networks using state-of-the-art statistical techniques. We show that the log-normal distribution is a better fit than the Gaussian distribution commonly claimed in the literature. We also investigate a second heavy-tailed distribution (the Weibull) and show that its performance is better than Gaussian but worse than log-normal. We examine anomalous traces which are a poor fit for all distributions tried and show that this is often due to traffic outages or links that hit maximum capacity. We demonstrate the utility of the log-normal distribution in two contexts: predicting the proportion of time traffic will exceed a given level (for service level agreement or link capacity estimation) and predicting 95th percentile pricing. We also show the log-normal distribution is a better predictor than Gaussian or Weibull distributions.