[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: comments on draft-ietf-psamp-sample-tech-04.txt

Benoit Claise wrote:

Hi Maurizio,

My point is that, if systematic time based sampling is implemented, will you do it like 1. or 2.
1. Case Systematic Time Based: - Interval length (in usec), Spacing (in usec)
2. Case Systematic Time Based: - Interval length (in usec), Spacing (# packets)

The option1 has got the big drawback that we have no idea how many packets will be inspected and as a consequence we don't know what are the bandwidth requirement for the export link(s). And if we do sampling, it's typically because we have a bottleneck on the export link(s) bandwidth or on the collector side...

I'm not 100% sure I understand what type of sampling you're speaking for or against.
However, in your upper sentence you say with Systematic Count based sampling (which includes 1 out of N), you don't have firm limits on the exported bandwidth.
That's true, but this type of sampling (*) allows you to estimate the rate of the link. With Systematic Time based you cannot see any rate variation on the link because you always export a packet each T sec. (actually, you can only understand if the rate drops below 1/T) .
So, Systematic Time based can be useful for a lot of applications (e.g. random packet content inspection), but not for understanding the dynamics on a link.

(*) and probabilistic sampling as well

to unsubscribe send a message to psamp-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/psamp/>