Billing
Internet usage, and thus internet traffic, tends to operate in cycles, with a "peak time" and an "off-peak time" recurring daily. Because of this cycle, the rate of traffic being delivered at the peak time is usually significantly higher than the "average" value.
A billing system based on the 95th percentile of traffic measurements was introduced in the US first by UUNET. Similar billing systems were subsequently introduced by the other major carriers, as a way to bill customers an amount that more accurately covers their costs of operating the network. For example, if a customer peaks at twice their average for 2 hours a day, the ISP must purchase expensive circuits large enough to handle this traffic even when it sits unused the other 22 hours. This would cost more than a customer that delivered the same "amount" of data, but spread out throughout the day at a steady rate. By measuring the "rate" of traffic being delivered instead of the "amount," the cost of the network is more accurately passed on to the customer. The top 5% of the peak rates are thrown away to ensure customers are only billed for consistent peaks and not short, occasional bursts.
The procedure used by UUNET for 95th percentile billing is to sample the rate of traffic on an interface once every 5 minutes, and record these values for one billing period (usually one month, for example 8640 samples for 30 days). At the end of the billing period, the samples are sorted in order from highest to lowest, the top 5% (ex: 432 samples, or the top 36 hours) is removed, and the value immediately under this (the 8208th sample) is the 95th percentile. This process is done twice, once for inbound traffic and once for outbound, and the larger of the two values is what is used to calculate the customer bill.
Many ISPs have developed variants on this billing method. Some bill for in + out instead of max(in, out), while others bill for (in+out)/2. If you are in doubt, or if you are comparing quotes between providers, you should make certain you know what method is being used.
