RE: a paper on packet sampling

["Peter Phaal" <Peter_Phaal@inmon.com>]

On Tue, 19 Mar 2002 22:19:07 -0600 (CST) Baek-Young Choi wrote:
> We have worked on packet sampling for traffic load
> estimation, which can be found at
>
> http://www.cs.umn.edu/~choiby/adaptiverandomsampling.ps
>
> Any comment would be appreciated.
>
> Thanks,
> --Baek-Young

The paper presents an interesting technique for varying sampling rate in
order to achieve a fixed error bound for load measurements made over time.

I can see the application of this technique to detecting a change in traffic
on a particular route, in a particular application class, from particular
sources etc.

In these cases it is likely that more than one measurement is being computed
at a time. You are not likely to be interested in only monitoring one route
at a time, but all routes. One could run the adaptive sampling algorithm on
each category independently. Taking the minimum of the resulting sampling
rates would ensure that all bins achieved the desired accuracy. The use of
packet sampling in these situations is compelling since there aren't simple
alternatives, particularly if the number of categories is large or changes
dynamically.

In this case the target sampling rate is something that needs to be
determined by the application, and used to control the sampling engine. A
different application tracking different categories would have a different
target sampling rate.

Provided that PSAMP allows sampling rates to be set by applications (through
a MIB for example) and exports the actual sampling rate used along with the
sampled data then an application would be free to adaptively control the
sampling rate according to this algorithm.

The paper could be clearer in idenfiying the problem being addressed. At
first I interpreted it as a technique for measuring the total load on a
link. A more direct way of identifying a change in load on a link is to poll
the ifInOctets/ifOutOctets counters maintained by virtually all network
devices. A discussion of the multivariate nature of load measurement would
make the application of the technique clearer.

I also wonder whether the technique would work as well in an intranet
environment. Were the traces primarily from busy Internet routers? Core
traffic tends to reflect a much larger population of users and have more
predictable statistical properties. In my experience, intranet traffic can
be heavily dominated by the characteristics of particular applications and
hosts. An extreme example would be monitoring an individual desktop
computer. It will show "on/off" types of traffic loads.  The link is mostly
idle, punctuated by heavy loads as files are opened, mail is sent etc. In
this case there is little predicive value in knowing the load in the
previous interval.

Peter
----------------------
Peter Phaal
InMon Corp.

Peter_Phaal@inmon.com


--
to unsubscribe send a message to psamp-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/psamp/>