workload: mice vs elephants

(generally, we do not yet know what we're talking about)

but we know not to analyze Internet flow sizes with less than 24 hours of data
btw, nobody has 24 hours worth of useful core packet trace data (we're $nMs away)