Inference of Flow Statistics via Packet Sampling in the Internet

TL;DR

This paper demonstrates that flow size distribution tails can be inferred from sampled data by rescaling, and proposes heuristics to recover the full distribution across backbone networks.

Contribution

It introduces a method to infer complete flow size distributions from packet sampling data using heuristics and rescaling techniques.

Findings

Tail of flow size distribution can be obtained by rescaling sampled data.

Heuristics enable recovery of the full flow size distribution.

Method applicable to backbone IP network measurements.

Abstract

We show in this note that by deterministic packet sampling, the tail of the distribution of the original flow size can be obtained by rescaling that of the sampled flow size. To recover information on the flow size distribution lost through packet sampling, we propose some heuristics based on measurements from different backbone IP networks. These heuristic arguments allow us to recover the complete flow size distribution.