  Getting good statistical models of traffic on network links is a well-known,
often-studied problem. A lot of attention has been given to correlation
patterns and flow duration. The distribution of the amount of traffic per unit
time is an equally important but less studied problem. We study a large number
of traffic traces from many different networks including academic, commercial
and residential networks using state-of-the-art statistical techniques. We show
that the log-normal distribution is a better fit than the Gaussian distribution
commonly claimed in the literature. We also investigate a second heavy-tailed
distribution (the Weibull) and show that its performance is better than
Gaussian but worse than log-normal. We examine anomalous traces which are a
poor fit for all distributions tried and show that this is often due to traffic
outages or links that hit maximum capacity.
  We demonstrate the utility of the log-normal distribution in two contexts:
predicting the proportion of time traffic will exceed a given level (for
service level agreement or link capacity estimation) and predicting 95th
percentile pricing. We also show the log-normal distribution is a better
predictor than Gaussian or Weibull distributions.
