Summary

  • The familiar description of 95th-percentile billing—sample traffic, discard the highest five percent, charge on the next value—leaves out much of the economics. A burstable service can combine a physical port ceiling, a lower minimum billed commitment, five-minute sampling, separate or combined traffic directions, port or geographic aggregation, a contractual overage rate and clauses that revive the economic significance of exceptional peaks. Change any of those and the same traffic can produce a different commercial result.
  • The discarded five percent is not a bank of “free burst hours.” Equinix, for example, documents 8,640 five-minute observations in a 30-day month and discards 432. Those observations represent 36 hours of intervals in aggregate, but they can be scattered throughout the month. The useful distinction is between statistical exclusion and calendar entitlement: the former removes ranked samples from one calculation; it does not grant the customer a continuous 36-hour period at port speed.
  • Measurement transparency is part of the product, not merely a post-billing convenience. Equinix makes three months of inbound and outbound percentile summaries available and permits detailed report downloads; Lumen documentation describes a graph of the samples used for its percentile point and a text view containing exact sample values. A buyer that cannot reconstruct the meter carries a different commercial risk from one that can.

A statistic is doing contractual work

The appeal of 95th-percentile billing is easy to understand. Networks are built to carry rates, not merely monthly byte totals. A customer may run at modest levels for most of a billing cycle yet occasionally need far more throughput. A pure flat-rate service can make the purchased ceiling the billing quantity. A pure usage model can instead meter transferred volume. A percentile model offers another allocation: preserve some ability to burst while making sustained high-rate use economically consequential.

That description, however, is only the shell. The contract determines what “sustained” means.

Equinix Internet Access is a useful current example because the same product family exposes several billing choices. Fixed bandwidth is policed at the selected maximum commitment. Usage-based billing applies a base monthly charge plus per-gigabyte public egress. Its dedicated-port burst model instead makes the selected commit a minimum recurring charge while allowing traffic to rise as high as the physical port speed. The monthly overage is then tied to the 95th-percentile traffic rate.

That makes three quantities economically distinct: the port ceiling, the commit and the measured percentile. Calling all three “bandwidth” obscures the mechanism. The port describes what the interface may physically pass. The commit describes the minimum commercial obligation. The percentile describes, under one particular sampling rule, how far billable use rose above that obligation.

The distinction is explicit in Lumen's current Internet Services Schedule. For Commit Plus Burst service, CDR or CIR is the minimum Internet bandwidth billed each month regardless of actual use. A PDR or PIR, where applicable, is the maximum available bandwidth. The same schedule offers flat-rate service in which the customer is not permitted to exceed the contracted level. Physical possibility and purchased billing quantity are therefore not synonyms even within one supplier's portfolio.

This is the first discipline for interpreting a bandwidth contract: separate the nominal capacity shown on the port from the capacity dependency that the customer is actually buying. A 10 Gbps interface with a 1 Gbps commit and burst rights is economically different from a 10 Gbps service that is flat-rated and capped at 10 Gbps, and different again from a volume-metered service delivered through the same nominal interface.

Five percent is not a calendar allowance

Equinix's published burst method makes the ranking mechanism unusually concrete. The company takes one sample every five minutes. In a 30-day month that produces 8,640 observations. At month end it ranks them from highest to lowest, discards the highest 432—five percent—and takes the highest remaining value as the month's usage measure. If that value exceeds the purchased commit, a burst charge applies. Equinix publishes the burst fee per excess Mbps as 1.5 × Monthly Charge / Commit Mbps.

The 432 discarded samples correspond to 2,160 minutes, or 36 hours, of five-minute intervals. But nothing in the ranking process requires those intervals to be adjacent. A traffic surge for five minutes on Monday, another on Thursday and thousands of separate bursts across the month can occupy the discarded tail just as a continuous high-rate episode could.

That is why describing 95th-percentile billing as giving a customer “36 free hours” is misleading. There is no countdown clock. The customer does not spend from a fixed block of burst time. The meter observes the whole month, ranks the observations retrospectively and removes a fraction of them.

The distinction matters operationally. Suppose engineers treat the discarded fraction as a calendar allowance and schedule a large transfer assuming that a certain number of hours are therefore economically invisible. The relevant question is not how much nominal “free time” remains. It is how many observations from all other peaks will rank above or below the scheduled transfer by the end of the billing cycle. Tail rank, not elapsed burst time, determines the result.

The contract is allocating tail-traffic risk. The buyer receives some tolerance for high observations, while the provider retains exposure to sustained elevation beyond the discarded tail. That allocation can be sensible or unsuitable depending on the workload. The statistic by itself supplies no verdict.

Direction changes the meter

Another apparently small clause can change the result: whether inbound and outbound traffic are combined, separately ranked or selectively billed.

Lumen's Commit Plus Burst terms say five-minute samples are taken for the prior five-minute period on both inbound and outbound traffic. The highest five percent are discarded separately for each direction, and the higher of the resulting inbound and outbound values is used to calculate applicable usage.

That is a different function from summing inbound and outbound first and calculating one percentile on the combined series. It is also different from billing only egress. The underlying packets may be identical, but the billing statistic is not.

Cloudflare WAN provides a related, but distinct, example. Its documentation says usage encompasses traffic to and from the WAN namespace over configured connection types including GRE, IPsec, Cloudflare Tunnel and Cloudflare Network Interconnect. Five-minute measurements are used, and for each tunnel Cloudflare uses the higher 95th-percentile value of ingress or egress traffic. This is useful corroboration that scope and direction are contractual dimensions of percentile measurement, not evidence of a universal Internet-transit formula.

For buyers, the practical issue is traffic asymmetry. A network with high inbound replication and lower outbound response traffic may behave differently under a “higher direction” rule than under an outbound-only model. A content-heavy business can have the opposite profile. The headline commit tells neither buyer enough.

Aggregation is an economic term

Aggregation creates another layer. Lumen's Internet schedule permits some Commit Plus Burst services to be supplied on an aggregated basis, where 95th-percentile burst usage can be calculated across included ports. Whether aggregation helps or hurts a particular customer depends on correlation among those ports.

If several sites peak at different times, aggregation may smooth the combined profile. If they peak together because they serve the same application event, maintenance window or global software release, aggregation can preserve the common peak. The point is not that aggregation has one predictable financial direction. It is that the aggregation boundary is part of the price.

Cisco's Umbrella SIG terms illustrate a more important mathematical difference outside Internet transit. The security-service supplement calculates a 95th-percentile peak separately at each Umbrella data centre carrying an end user's traffic, then adds those location-level peak values together.

“Calculate at each location, then sum” is not generally equivalent to “sum traffic across locations, then calculate the percentile.” Peaks that occur at different times can produce very different results under the two methods. The Cisco example should therefore be read as a security-service demonstration of how ordering and scope affect a percentile calculation, not as a quote for wholesale transit.

This is where contracts that appear to share one metric begin to diverge materially. The common phrase “95th percentile” is thin. The economically meaningful object is the full measurement function: which interfaces, which locations, which directions, which interval, which aggregation order and which billing period.

The discarded tail may still matter

A naïve reading of percentile billing assumes that discarded observations are commercially irrelevant. Some contracts show why that conclusion cannot be generalized.

Lumen's separate Content Delivery Network Service Schedule is explicitly a CDN document, not its Internet-transit schedule. For certain CDN services it defines the 95th-percentile sample at the regional level from outbound traffic. It also defines a “Disproportionate Peak” as a sample above three times the relevant 95th-percentile sample. Under the schedule, Lumen reserves rights to invoice usage above the percentile under an Actual Usage method in such circumstances, and separately addresses abusive manipulation of usage intended to lower the percentile.

The lesson is contractual rather than vendor-specific: discarding a sample in the ordinary percentile calculation does not prove that the contract makes that sample economically meaningless for every other purpose. An exceptional-peak clause can reattach consequences to the tail.

That distinction becomes important when buyers compare offers with identical-looking commits and overage rates. One offer may simply exclude a specified fraction of samples. Another may exclude them from the ordinary percentile meter but preserve repricing, abuse or other rights around exceptional behaviour. The risk being transferred is different even if both order forms contain “95th percentile.”

A commercial review that records only port size, commit and price per Mbps therefore leaves material exposure undocumented.

Redundancy creates a second capacity question

Redundant links introduce another source of misleading headline capacity. Equinix's fixed-bandwidth documentation says that where redundant connections are used, the selected maximum bandwidth commitment applies to both primary and secondary connections rather than being split between them. With balanced traffic, the pair can carry up to twice the selected bandwidth commit; after failure of one connection, only the selected commit is guaranteed.

This is service-specific evidence, not a general law of redundant Internet access. Its analytical value is narrower: capacity during normal operation and capacity after a failure are separate dependencies.

For an application owner, the useful number may therefore be neither the sum of all physical ports nor the pre-failure aggregate. It may be the throughput available in the topology's degraded state. For procurement, that means asking whether the bandwidth billing construct and the resilience construct are aligned. Buying large nominal burst headroom on two links does not by itself establish what the application can rely on when one disappears.

The meter needs an audit trail

Percentile billing creates an unusually strong reason for measurement evidence because the invoice can turn on one surviving observation near a ranking threshold.

Equinix exposes three months of inbound and outbound traffic summaries and allows customers to download a detailed port report. Lumen's Control Center documentation for burstable billing describes a graph containing the collected samples, a marked percentile line and a text view showing exact sample values.

That changes the commercial quality of the meter. A buyer with only a monthly invoice receives a result. A buyer with timestamped source data can test the result: sample interval, direction, missing periods, aggregation boundaries, the number of discarded points and the surviving percentile value.

The common meter should be as thin as possible: deterministic enough that two parties using the same input data and rule produce the same answer. Every additional discretionary step—undocumented normalization, inaccessible aggregation logic or an opaque exception—raises verification cost.

This does not mean every buyer must duplicate a carrier's billing platform. It means reconstructability is a procurement attribute. The buyer should know what evidence exists if finance, network operations and the supplier produce different interpretations.

That attribute can affect competition. A provider that makes the bill easy to reproduce lowers the customer's monitoring and switching burden. Retention then depends more on network delivery, operational support and commercial fit, and less on the friction of deciphering measurement.

Security traffic exposes the boundary

DDoS events are a common source of confusion because an attack is simultaneously a capacity event, a security event and potentially a metering event.

Equinix advises customers to monitor usage and configure alerts for large spikes. Its Internet Access security documentation also describes automatic blackholing of a single IP address when traffic and packet-rate thresholds form a pattern suggesting a volumetric attack; traffic to that address is then dropped until the condition is cleared.

Those facts establish operational exposure. An attack can create a sudden traffic surge, and the network contains mechanisms intended to protect upstream capacity. They do not establish the universal billing treatment of DDoS traffic. Whether attack traffic enters a particular bill depends on where it is measured, when mitigation activates, the billing service involved and the governing terms.

That boundary should remain explicit. A security document cannot silently be converted into an Internet-billing clause.

For buyers with material attack exposure, the commercial question is therefore not “does 95th percentile ignore DDoS?” It is whether the order, service schedule and mitigation architecture jointly define what happens to metered traffic before and after mitigation. If that answer matters economically, it belongs in the contract review rather than in an assumption.

Percentile billing is a choice, not a natural law

The final corrective is comparative. Networks do not have to be sold through percentiles.

Equinix itself documents fixed, usage-based and burst models for relevant Internet Access configurations. Lumen offers both flat-rate and Commit Plus Burst forms. IBM Cloud Classic documents another model: public egress measured in bytes against monthly allocations, with devices optionally placed into geographically defined bandwidth pools so that allocation and usage are consolidated and an overage occurs when pooled usage exceeds pooled allocation.

Those alternatives demonstrate why 95th-percentile billing should not be evaluated as inevitable infrastructure plumbing. It is one way to price a particular risk profile.

For some traffic patterns, a buyer may value burst headroom above a lower minimum commit. Another may prefer the predictability of a fixed cap. Another may prefer volume allocations because bytes, rather than sustained rate, better match its economic unit. None of these statements establishes which model is cheaper without the workload, rates and contract.

The useful procurement question is narrower and more rigorous: what uncertainty is the supplier taking, what uncertainty remains with the buyer, and can both sides observe the boundary?

A port marked 10 Gbps answers almost none of that.

The real service is the combination of physical ceiling, minimum obligation, meter, exception rules and evidence. Once those are separated, the 95th percentile stops looking like an abstract networking convention and starts looking like what it is: a contractual allocation of tail risk.

Sources