Flow Slices dynamically adjusts the flow slicing probability to the current
traffic. This adjustment can happen in the middle of a time bin. Which one of
the many values of
should we use in our estimators? Are the estimators still
unbiased? Actually none of the proofs depends on having a single value for
,
and they would all work if we replaced it with a separate
for every
packet. All the estimators would need to use the value of the packet slicing
probability in effect at the time the sampling of a packet caused the creation
of the entry. This doesn't necessarily mean that one needs to extend the flow
entry with one more field, because it already holds the timestamp of the first
packet and that can be used to determine the flow slicing rate if the router
keeps a small log of recent adjustments to it.
When the flow record expires and it is reported, the report should include the
value of the flow slicing probability in effect at the time the entry was
created. Similarly if the smart sampling thresholds
,
, and
are
adjusted dynamically, the report should include their current value so that one
can compute
during analysis. If one uses just a few possible
values for these parameters (e.g. only powers of two), each of these
sampling rates can be encoded in less than one byte, so the reporting
overhead they impose is limited (a flow record has 48 bytes).