Why Averages Lie
Most monitoring systems poll network devices once per minute using SNMP or cloud APIs. They collect the total bytes transferred during that interval and divide by 60 to produce an "average bandwidth" figure. This number is displayed on your dashboard as a smooth, reassuring line.
The problem: networks don't behave smoothly. Traffic arrives in bursts — a batch job starts, 50 users hit refresh simultaneously, a backup kicks off. These bursts can be extremely short-lived, measured in milliseconds, but their impact is real and severe.
Scenario:
- You have a 1 Gbps WAN link.
- For 59.9 seconds of a given minute, traffic is near zero.
- For 100 milliseconds, traffic spikes to 2 Gbps (a large file transfer starts, multiple TCP flows ramp up simultaneously).
What your dashboard shows: Average utilization ≈ 3 Mbps. "Plenty of headroom."
What actually happened: During that 100ms burst, the switch's output buffer filled instantly. The switch had no choice but to drop packets. Video calls froze. Database transactions timed out. TCP connections stalled waiting for retransmissions.
This is a micro-burst: a sub-second traffic spike that exceeds link capacity, causes packet drops, and is completely invisible to minute-level polling. The averaging process mathematically erases the evidence.