Peter Haag wrote: > Hi list, > I need some information from those of you using sampling in your > network. > > If you have several netflow sources you feed into NfSen, do all > the sources have the same sampling rate?
yes, 1/1000. Though in the future, if we introduce new routers, we may have different ones > > If not, why do you have different sampling rate? > > Would it be feasible for you to adjust all sources to the same > sampling rate? > > > Have you best practices formulas for estimating real traffic, or > do you operate just using a multiplication with the sampling rate? For the number of packets, the mutiplication is always right (i.e. it is an "unbiased estimator", in statistical terms...). What needs to be controlled is the precision of the estimate you obtain. That is, you multiply, you get a number, and you say: what is the probability that this number is the real number +- an error bound? In a document I sent you off-list I was claiming that for gettig an error bound lower than 10 % with a probability of 95%, you needed at least 400 *sampled* packets. I can send this doc to the list, I'd appreciate comments to check if it's flawed. It has some maths, though.....shall I? For the number of bytes the same reasoning applies, provided that the N sampled packets you use (e.g. the 400 I was mentioning...) have a distribution of the packet sizes close to the real one. If we had this distribution, I immagine that an easy formula to would be to compute the standard deviation of the packet size, compare it to the average packet size (i.e. get a relative error..), and add this to the error mentioned above. Unfortunately, we don't have this distribution, as in a flow record you only have the total no of bytes. The single packet sizes (not their standard deviation) are not reported I have to see if IPFIX worked on that.... For the number of flows, the multiplication is NOT correct. It is an unsolved problem (better, in recent literature there were papers by Duffield and Hohn on that, but they don't by sure provide an "easy" formula...). Regards, Maurizio > > > Input is appreciated for implementing a proper way of sampling into NfSen. > > Many thanks. > > - Peter > ------------------------------------------------------------------------- This SF.net email is sponsored by DB2 Express Download DB2 Express C - the FREE version of DB2 express and take control of your XML. No limits. Just data. Click to get it now. http://sourceforge.net/powerbar/db2/ _______________________________________________ Nfsen-discuss mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
