How do you do capacity planning for a network? When do you upgrade a link?
Show the answer
Say this first
Baseline what you have, watch the trend, and upgrade before users feel it, leaving time for lead times. I track utilization at peak using the 95th percentile rather than averages, plus drops and errors, and use a rule-of-thumb trigger around sustained 60 to 70 percent at peak, lower on links that must absorb a partner's load when it fails. Capacity is also more than bandwidth: firewall sessions, TCAM and route table size, PoE budget, DHCP scopes, IP space and ports.
Go deeper
Measure
- Interface counters by SNMP or streaming telemetry at 1 to 5 minute intervals. Look at the busy hour and the 95th percentile, not the monthly average.
- Output drops and discards, which show congestion that utilization graphs smooth over.
- NetFlow or IPFIX to know who and what uses the link, so you can tell growth from one rogue backup job.
Plan for failure
In a pair of links that share load, each must stay under about 50 percent at peak, or the survivor cannot carry both when one fails. The same applies to firewall and router pairs.
Forecast
- Trend the busy-hour figures monthly and project when you will cross the trigger.
- Add known events: a new office, a cloud migration, a video platform rollout.
- Work back from lead times. New circuits commonly take weeks to months, and hardware can too.
Capacity beyond bandwidth
| Resource | Runs out as |
|---|---|
| Firewall | Concurrent sessions, new connections per second, inspected throughput |
| NAT | PAT ports per public address |
| Switch tables | MAC, ARP, routes, TCAM for ACLs and QoS |
| Addressing | DHCP scopes, free blocks that still summarize |
| Access | Free ports, PoE budget, UPS runtime |
| Wireless | Clients per AP and airtime |
Say it in business terms
"At the current trend this link reaches 70 percent at peak in five months. A circuit upgrade takes about three months. We should order it now."
They will ask next
Why the 95th percentile?
It throws away the top 5 percent of samples, so brief spikes do not dominate but sustained busy periods do. With 5-minute samples over 30 days, that ignores the busiest 36 hours of the month. Many ISPs bill burstable circuits the same way.
Traps
- Planning from averages. A link at 30 percent average can be full every morning at 9.
- Forgetting the N-1 case for redundant pairs.