Maurizio Molina escreveu: > > I'd like to remark that the re-normalization of netflow data after > sampling brings two issues: > 1) multiplying the number of packets and bytes by the inverse of the > sampling rate to obtain the real figure is an unbiased estimator (i.e. > it is correct), while for the number of flows it is not. Therefore, if > one chooses to give the re-normalized figure of the flows anyway, one > should at least add a warning that the information is not > representative of the real figure. > 2) Also for packets and bytes, the re-normalized figure is affected by > an uncertainty that should be reported along with the figure, not to > give the user eccessive "trust" in potentially wrong figures. There are > simple statistical formulas that can be applied and I'd be happy to > discuss them in the list, if there is consensus that this can be helpful. > Regards, > Maurizio
Good point! I´ve heard some info about these statisticial issues but I haven´t analized it in a more formal mathematical way (i.e. I haven´t read any paper about it ;). So, at least to me, your pointers would be really appreciated. Of course, once we start to use sampling, we already know some information is lost. Is pretty easy to understand that smaller sampling rates lead to a higher degree of uncertainity. But I believe that, at least with pipes like STM-16, STM-64 and 10GigE, sampling are a must on routers. So, any discussion (and some implementation ;) regarding this issue would be great. -- Raniery Pontes :::::::::::::::::::::: [EMAIL PROTECTED] http://www.rnp.br/en/ceo/ ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys -- and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ Nfsen-discuss mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
