Hi Maurizio, I am also interested in this document, so if you could send it to me i would much appreciate it. Thanks in advance!
Koen Adrian Popa wrote: > Hello Maurizio, > > It's very interesting what you are saying about sampling, and I would > like to get more information about it, so I think the document you are > talking about is interesting. If it is large, and you don't want to > flood the list, can you send it to me? > > Thank you, > Adrian Popa > > On 5/31/07, *Maurizio Molina* <[EMAIL PROTECTED] > <mailto:[EMAIL PROTECTED]>> wrote: > > Peter Haag wrote: > > > Hi list, > > I need some information from those of you using sampling in your > > network. > > > > If you have several netflow sources you feed into NfSen, do all > > the sources have the same sampling rate? > > yes, 1/1000. Though in the future, if we introduce new routers, we > may > have different ones > > > > > If not, why do you have different sampling rate? > > > > Would it be feasible for you to adjust all sources to the same > > sampling rate? > > > > > > Have you best practices formulas for estimating real traffic, or > > do you operate just using a multiplication with the sampling rate? > > > For the number of packets, the mutiplication is always right (i.e. it > is an "unbiased estimator", in statistical terms...). > What needs to be controlled is the precision of the estimate you > obtain. That is, you multiply, you get a number, and you say: what is > the probability that this number is the real number +- an error bound? > In a document I sent you off-list I was claiming that for gettig an > error bound lower than 10 % with a probability of 95%, you needed at > least 400 *sampled* packets. I can send this doc to the list, I'd > appreciate comments to check if it's flawed. It has some maths, > though.....shall I? > > For the number of bytes the same reasoning applies, provided that the > N sampled packets you use (e.g. the 400 I was mentioning...) have a > distribution of the packet sizes close to the real one. If we had this > distribution, I immagine that an easy formula to would be to compute the > standard deviation of the packet size, compare it to the average packet > size (i.e. get a relative error..), and add this to the error mentioned > above. Unfortunately, we don't have this distribution, as in a flow > record you only have the total no of bytes. The single packet sizes (not > their standard deviation) are not reported > I have to see if IPFIX worked on that.... > > For the number of flows, the multiplication is NOT correct. It is an > unsolved problem (better, in recent literature there were papers by > Duffield and Hohn on that, but they don't by sure provide an "easy" > formula...). > Regards, > Maurizio > > > > > > > Input is appreciated for implementing a proper way of sampling > into NfSen. > > > > Many thanks. > > > > - Peter > > > > > ------------------------------------------------------------------------- > > This SF.net email is sponsored by DB2 Express > Download DB2 Express C - the FREE version of DB2 express and take > control of your XML. No limits. Just data. Click to get it now. > http://sourceforge.net/powerbar/db2/ > _______________________________________________ > Nfsen-discuss mailing list > [email protected] > <mailto:[email protected]> > https://lists.sourceforge.net/lists/listinfo/nfsen-discuss > > > > ------------------------------------------------------------------------ > > ------------------------------------------------------------------------- > This SF.net email is sponsored by DB2 Express > Download DB2 Express C - the FREE version of DB2 express and take > control of your XML. No limits. Just data. Click to get it now. > http://sourceforge.net/powerbar/db2/ > > > ------------------------------------------------------------------------ > > _______________________________________________ > Nfsen-discuss mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/nfsen-discuss ------------------------------------------------------------------------- This SF.net email is sponsored by DB2 Express Download DB2 Express C - the FREE version of DB2 express and take control of your XML. No limits. Just data. Click to get it now. http://sourceforge.net/powerbar/db2/ _______________________________________________ Nfsen-discuss mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
