Check out the new USENIX Web site. next up previous
Next: Bins, timeouts, and flow Up: Estimators based on flow Previous: Multi-factor smart sampling

Dynamically adjusting the flow slicing probability

Flow Slices dynamically adjusts the flow slicing probability $ p$ to the current traffic. This adjustment can happen in the middle of a time bin. Which one of the many values of $ p$ should we use in our estimators? Are the estimators still unbiased? Actually none of the proofs depends on having a single value for $ p$, and they would all work if we replaced it with a separate $ p_i$ for every packet. All the estimators would need to use the value of the packet slicing probability in effect at the time the sampling of a packet caused the creation of the entry. This doesn't necessarily mean that one needs to extend the flow entry with one more field, because it already holds the timestamp of the first packet and that can be used to determine the flow slicing rate if the router keeps a small log of recent adjustments to it.

When the flow record expires and it is reported, the report should include the value of the flow slicing probability $ p$ in effect at the time the entry was created. Similarly if the smart sampling thresholds $ z_s$, $ z_b$, and $ z_a$ are adjusted dynamically, the report should include their current value so that one can compute $ r$ during analysis. If one uses just a few possible values for these parameters (e.g. only powers of two), each of these sampling rates can be encoded in less than one byte, so the reporting overhead they impose is limited (a flow record has 48 bytes).


next up previous
Next: Bins, timeouts, and flow Up: Estimators based on flow Previous: Multi-factor smart sampling
Ramana Rao Kompella 2005-08-12