Merit Network
Can't find what you're looking for? Search the Mail Archives.
  About Merit   Services   Network   Resources & Support   Network Research   News   Events   Home

Discussion Communities: Merit Network Email List Archives

North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: representativeness of flow data based on samples

  • From: Peter Phaal
  • Date: Fri Feb 01 17:31:49 2002

On Wed Jan 30 14:04:40 2002, Joe Abley wrote:
>There are a few vendors who now provide traffic export from high-speed
>interfaces by sampling those interfaces at a particular rate, and
>using the sampled packets to populate the per-flow counters, rather
>than looking at every packet.

>Does anybody here know of recent research with real internet traffic
>which compares different sample rates wrt the representativeness of
>the resulting flow data?

On Wed Jan 30 23:50:11 2002, Fred True replied:
| You might find this related talk useful:
| http://www.research.att.com/~duffield/pubs/usage-imw2001.pdf

While the Duffield talk mentions packet sampling, it is primarily concerned
with sampling flow records in order to reduce the post-processing overhead
(i.e. it addresses the accuracy of sampling exported netflow records, rather
than the accuracy of netflow records generated using packet sampling).

Here are a few references that address the issue of packet sampling
accuracy:
http://www.inmon.com/PDF/sFlowBilling.pdf
http://www.hpl.hp.com/techreports/92/HPL-92-35.html
http://www.caida.org/outreach/papers/1993/asmw/

I don't know of any other published studies. However, I have been involved
in a number of unpublished tests in which sampling was demonstrated to
produce valid results with sufficient accuracy (provided that suitable
sampling rates and aggregation periods are selected).

Peter





Discussion Communities


About Merit | Services | Network | Resources & Support | Network Research
News | Events | Contact | Site Map | Merit Network Home


Merit Network, Inc.