[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: comments on draft-ietf-psamp-sample-tech-04.txt
Benoit Claise wrote:
My point is that, if systematic time based sampling is implemented,
will you do it like 1. or 2.Benoit,
1. Case Systematic Time Based: - Interval length (in usec),
Spacing (in usec)
2. Case Systematic Time Based: - Interval length (in usec),
Spacing (# packets)
The option1 has got the big drawback that we have no idea how many
packets will be inspected and as a consequence we don't know what are
the bandwidth requirement for the export link(s). And if we do
sampling, it's typically because we have a bottleneck on the export
link(s) bandwidth or on the collector side...
I'm not 100% sure I understand what type of sampling you're speaking for
However, in your upper sentence you say with Systematic Count based
sampling (which includes 1 out of N), you don't have firm limits on the
That's true, but this type of sampling (*) allows you to estimate the
rate of the link. With Systematic Time based you cannot see any rate
variation on the link because you always export a packet each T sec.
(actually, you can only understand if the rate drops below 1/T) .
So, Systematic Time based can be useful for a lot of applications (e.g.
random packet content inspection), but not for understanding the
dynamics on a link.
(*) and probabilistic sampling as well
to unsubscribe send a message to firstname.lastname@example.org with
the word 'unsubscribe' in a single line as the message text body.