Hello Maurizio,
It's very interesting what you are saying about sampling, and I would like
to get more information about it, so I think the document you are talking
about is interesting. If it is large, and you don't want to flood the list,
can you send it to me?
Thank you,
Adrian Popa
On 5/31/07, Maurizio Molina <[EMAIL PROTECTED]> wrote:
Peter Haag wrote:
> Hi list,
> I need some information from those of you using sampling in your
> network.
>
> If you have several netflow sources you feed into NfSen, do all
> the sources have the same sampling rate?
yes, 1/1000. Though in the future, if we introduce new routers, we may
have different ones
>
> If not, why do you have different sampling rate?
>
> Would it be feasible for you to adjust all sources to the same
> sampling rate?
>
>
> Have you best practices formulas for estimating real traffic, or
> do you operate just using a multiplication with the sampling rate?
For the number of packets, the mutiplication is always right (i.e. it
is an "unbiased estimator", in statistical terms...).
What needs to be controlled is the precision of the estimate you
obtain. That is, you multiply, you get a number, and you say: what is
the probability that this number is the real number +- an error bound?
In a document I sent you off-list I was claiming that for gettig an
error bound lower than 10 % with a probability of 95%, you needed at
least 400 *sampled* packets. I can send this doc to the list, I'd
appreciate comments to check if it's flawed. It has some maths,
though.....shall I?
For the number of bytes the same reasoning applies, provided that the
N sampled packets you use (e.g. the 400 I was mentioning...) have a
distribution of the packet sizes close to the real one. If we had this
distribution, I immagine that an easy formula to would be to compute the
standard deviation of the packet size, compare it to the average packet
size (i.e. get a relative error..), and add this to the error mentioned
above. Unfortunately, we don't have this distribution, as in a flow
record you only have the total no of bytes. The single packet sizes (not
their standard deviation) are not reported
I have to see if IPFIX worked on that....
For the number of flows, the multiplication is NOT correct. It is an
unsolved problem (better, in recent literature there were papers by
Duffield and Hohn on that, but they don't by sure provide an "easy"
formula...).
Regards,
Maurizio
>
>
> Input is appreciated for implementing a proper way of sampling into
NfSen.
>
> Many thanks.
>
> - Peter
>
-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
