Deterministic Versus Probabilistic Packet Sampling in the Internet

摘要

Under the assumption that packets are sufficiently interleaved and the sampling rate is small, we show in this paper that those characteristics of flows like the number of packets, volume, etc. obtained through deterministic 1-out-of-k packet sampling is equivalent to random packet sampling with rate p = 1/k. In particular, under mild assumptions, the tail distribution of the total number of packets in a given flow can be estimated from the distribution of the number of sampled packets. Explicit theoretical bounds are then derived by using technical tools relying on bounds of Poisson approximation (Le Cam's Inequality) and refinements of the central limit theorem (Berry-Essen bounds). Experimental results from an ADSL traffic trace show good agreement with the theoretical results established in this paper.