workload: mice vs elephants

longer traces are essential
for a 48 min (sjc) packet trace (15GB), 22% packets are in still-active flows
50% packets are in flows with > 1024 pkts
for 3 min (sjc) trace, 70% packets in still-active flows
for each 2X in sample duration, 2X in max of pkt/flow
convergence nowhere in sight

repeat do not analyze flow sizes with less than 24 hours of data