North American Network Operators Group
Date Prev | Date Next |
Date Index |
Thread Index |
Author Index |
Historical
Re: representativeness of flow data based on samples
- From: Peter Phaal
- Date: Fri Feb 01 17:31:49 2002
On Wed Jan 30 14:04:40 2002, Joe Abley wrote:
>There are a few vendors who now provide traffic export from high-speed
>interfaces by sampling those interfaces at a particular rate, and
>using the sampled packets to populate the per-flow counters, rather
>than looking at every packet.
>Does anybody here know of recent research with real internet traffic
>which compares different sample rates wrt the representativeness of
>the resulting flow data?
On Wed Jan 30 23:50:11 2002, Fred True replied:
| You might find this related talk useful:
| http://www.research.att.com/~duffield/pubs/usage-imw2001.pdf
While the Duffield talk mentions packet sampling, it is primarily concerned
with sampling flow records in order to reduce the post-processing overhead
(i.e. it addresses the accuracy of sampling exported netflow records, rather
than the accuracy of netflow records generated using packet sampling).
Here are a few references that address the issue of packet sampling
accuracy:
http://www.inmon.com/PDF/sFlowBilling.pdf
http://www.hpl.hp.com/techreports/92/HPL-92-35.html
http://www.caida.org/outreach/papers/1993/asmw/
I don't know of any other published studies. However, I have been involved
in a number of unpublished tests in which sampling was demonstrated to
produce valid results with sufficient accuracy (provided that suitable
sampling rates and aggregation periods are selected).
Peter
|
