workload: mice vs elephants

longer traces are essential
two modes of Internet usage (interactive, downloads)
boundary between modes is ~300 packets (0.5 MBytes)
most flows on the left (by far),  most packets on the right (by far)	
for a 24 hour (sd) flow table, 4.7% packets are in still-active flows
50% packets are in flows with > 8192 pkts; max. flow: 9M pkts. max. active flow: 5M packets.

upshot: do not analyze flow sizes with less than 24 hours of data