Your twelve sites each graph their own traffic — how do you produce one credible number for what the estate received?

## Why the number does not exist yet An executive has been told the distributed footprint absorbs attacks. After an incident someone asks the obvious question — how much did we actually take? — and discovers that twelve dashboards showing twelve local graphs do not answer it. Nothing in the design ever computed a sum, so the number has to be constructed, and constructed defensibly, because the people asking are being asked to fund capacity on the strength of it. ## Build the aggregate, then distrust it **One collector, one clock.** Every site's edge exports flow records — five-tuple, byte and packet counts, start and end timestamps — to a single collector. If site clocks drift, records land in the wrong bucket and a synchronised burst smears into a plateau, which understates the peak. Time synchronisation is not housekeeping here; it is the difference between a peak and an average. **Scale sampled export correctly.** Most edge exporters sample: one packet in a thousand, one in ten thousand. A record's byte count then represents its sample, and the site's real volume is the count multiplied by that site's rate. Two sites configured at different rates and summed without scaling produce a total that is wrong by whatever ratio the misconfiguration happens to be, in a direction nobody will spot, because the result still looks like a plausible traffic graph. Confirm the rate per exporter, not per site, and record it beside the figure. **Count each packet once.** A flood traversing a site can be observed at more than one interface. Sum across interfaces without deciding a counting boundary and you double the estate total — which is a very comfortable error to make when you want a big number, and an embarrassing one to have found for you later. **Report peak, not volume.** "We absorbed 43 TB" sounds impressive and answers nothing. Capacity is a rate problem: what matters is the highest per-second bits and packets each site had to carry, and the estate-wide peak at the same instant. Publish both the estate peak and the per-site peaks, because a comfortable estate peak can hide one site that ran at ninety percent. ## The part your own data cannot show Interface counters measure what arrived at the interface. Once an upstream link saturates, traffic is discarded before it — so your records stop measuring the attack and start measuring your own link capacity. The graph flattens at the ceiling and looks calm. The only source for what was actually sent toward you is the transit providers', so an honest total either includes their figures or states that it is a floor. The same applies to the sites' shares. A share is a share of what you received, not of what was aimed at you, and the two diverge exactly when the incident is worst. ## Saying the uncomfortable sentence If no site ever crossed a threshold, the write-up cannot claim detection. There are two different claims and they are funded differently: | Claim | What it needs as evidence | | --- | --- | | "We absorbed it" | Reconstructed flow totals, per-site peaks, no user-visible degradation | | "We detected and absorbed it" | An alert with a timestamp before anyone noticed, and a responder who acted | Only the first is available, and the second is what the audience assumed they were buying. Saying so is the whole value of the write-up, because it converts a quiet week into the argument for the aggregation work that would have produced an alert. And note the adversary's position in this. An attacker who repeats the exercise learns your estate's shape from the outside — which sources reach which site, and what volume passes without a response — and the absence of any reaction is the most useful thing you can teach them. Nothing about that appears in a byte total. ## What to hand over A defensible package is short: the estate peak rate with the time it occurred; per-site peaks and shares; the sampling rate and counting boundary used, so the arithmetic can be re-run by someone who does not trust it; the upstream providers' figures or an explicit note that yours is a floor; and a plain statement of what fired, what did not, and who found out first. Numbers presented without those qualifications are the ones that get taken apart in the room, and once one figure is shown to be double-counted the whole absorption claim goes with it.