Packet capture is traditionally counter-based. The capture process is built in form of an infinite loop where one loop is executed for each packet. In order to sample packets, m out of n packets are skipped, which is implemented as a shorter loop by executing "continue" early for those m packets. This process is accurate because packets can be accurately counted, but creates unnecessary overhead. This paper looks into the possibility of emulating this process in time.
展开▼
