|
|
||
Ramana Rao Kompella, Cristian Estan Internet Measurement Conference, October 2005 Network service providers use high speed flow measurement solutions in routers to track dominant applications, compute traffic matrices and to perform other such operational tasks. These solutions typically need to operate within the constraints of the three precious router resources -- CPU, memory and bandwidth. Cisco's NetFlow, a widely deployed flow measurement solution, uses a configurable static sampling rate to control these resources. In this paper, we propose Flow Slices, a solution inspired from previous enhancements to NetFlow such as Smart Sampling, Adaptive NetFlow (ANF). Flow Slices, in contrast to NetFlow, controls the three resource bottlenecks at the router using separate ``tuning knobs''; it uses packet sampling to control CPU usage, flow sampling to control memory usage and finally multi-factor smart sampling to control reporting bandwidth. The resulting solution has smaller resource requirements than current proposals (up to 80% less memory usage than ANF), enables more accurate traffic analysis results (up to 10% less error than ANF) and balances better the error in estimates of byte, packet and flow counts (flow count estimates up to 8 times more accurate than after Smart Sampling). We provide theoretical analyses of the unbiasedness and variances of the estimators based on Flow Slices and experimental comparisons with other flow measurement solutions such as ANF. Paper in PDF and Postscript. The technical report version of this paper has the derivations for the variances of the estimators presented in this paper. |
