Packet count variance

For the core flow slicing algorithm we can compute the variance of the packet count estimator.

$$VAR[\widehat{s}]=1/p(1/p-1)(1-(1-p)^s)$$ (7)

Note how this variance is strictly lower than the variance of results based on random packet sampling $(1/p-1)s$ except for the case of $s=1$ when the two variances are equal. The higher $s$, the larger the difference between the variance of results based on flow slicing when compared with packet sampling. Since using the same sampling probability will give the same memory usage for flow slicing and ordinary sampling, this comparison of variances shows us that flow slicing is a superior solution. The advantage is most apparent when estimating the traffic of aggregates with much traffic coming from large flows.

The same conclusion holds if we compare the combination of packet sampling and flow slicing used by Flow Slices to the pure packet sampling used by Adaptive NetFlow and Sampled NetFlow. Here the fair comparison is with Sampled NetFlow using a packet sampling probability of $pq$. We can conceptually divide this into a first stage of packet sampling that samples packets with probability $q$ and a second one that samples them with probability $p$. The first stage has identical statistical properties for the two solutions, thus the difference in the accuracy is given by the second stage, but comparing the second stages reduces to comparing flow slicing and packet sampling using the same probability $p$.