RE: next step

["Sonia Panchen" <sonia_panchen@inmon.com>]

Derek Chiou wrote:

> Packet filtering can be applied anywhere where packets can be observed.
> It should be done at a place where it is both convenient and from where
all
> packets you are interested in are observable.  Ideally, devices from which
an
> aggregate report is generated should sample at the same place.
> For example,  if one router samples on egress and the next router samples
on
> ingress, you get very little additional information from the second
sampler.

I agree that filtering/sampling should be done at the most convenient place.
I think that convenience also implies not impacting routing/switching
performance.
Since the accuracy of a report is dependent on the number of samples that
were used to make that report
(http://www.hpl.hp.com/techreports/92/HPL-92-35.pdf), collecting and
aggregating samples from multiple observation points (which may have seen
the same traffic), makes the reports more accurate. So there is value in
sampling in multiple places which see the same traffic. Particularly if
there is no performance penalty - which is possible.

An advantage of this, is it gives router and switch developers more freedom
to implement sampling in a convenient place.

Sonia Panchen
InMon Corp


--
to unsubscribe send a message to psamp-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/psamp/>