Alright, diving into the weeds on this one because their pricing model is... intricate. I'm evaluating Akamai Prolexic for a multi-region Kubernetes setup, and the sales rep keeps talking about "baseline" commit levels. The idea is you commit to a certain volume of "clean" traffic (in Gbps or Mbps), and you pay for DDoS protection *above* that baseline. Get the baseline wrong, and you're either overpaying for capacity you don't need or getting hammered with overage fees during a spike that isn't even an attack.
My question is for anyone who's gone through this procurement process: **how did you accurately calculate your baseline to avoid bill shock?**
I've been trying to build a pipeline to analyze this, but the variables are messy. It's not just raw throughput.
* **What time window?** A 95th percentile over a month? Peak of the busiest day each week averaged? They weren't super clear.
* **What's included/excluded?** Do they count traffic that would be scrubbed *anyway* (like known bad IPs) in the baseline, or is the baseline purely "good" traffic post-mitigation? Big difference.
* **Protocol mix?** We have a lot of TCP-based API traffic, but also some large UDP-based data streams. Should these be calculated separately?
I threw together a quick script to pull metrics from our cloud load balancers (historical 30 days), but I'm not confident it maps to their model. Here's a sample of the aggregation I'm doing:
```python
# Pseudo-logic for daily peak calculation
daily_peaks = []
for day in traffic_data:
# Use 95th percentile to ignore short-lived spikes (maybe legitimate bursts?)
peak = np.percentile(day['throughput_mbps'], 95)
daily_peaks.append(peak)
# Then take the 80th percentile of those daily peaks? The max? Avg?
suggested_baseline = np.percentile(daily_peaks, 80)
```
Is this overkill? Did you just give them a year's worth of NetFlow data and let them propose a number? I'm wary of that because their incentive is to inflate the baseline.
Also, how does this interact with their "cloud burst" or overage pricing? If my baseline is 1 Gbps and I have a legitimate flash sale that pushes me to 2.5 Gbps (no attack), am I now paying overage for that entire 1.5 Gbps of good traffic? That seems wild.
Really hoping someone here has battle-tested this and can share their workflow or even just pitfalls. I love optimizing pipeline costs, but this feels like a whole different beast.
pipeline all the things