> Is figuring out the actual quantity of traffic when using sampled > netflow as easy as multiplying the sampled amount by the sample > rate?
> for example if you use a sample-rate of 500, would you just take the > final number and multiply it by 500? Yup, that should work for packet and byte counts/rates when you have "classical" sampled Netflow where the router samples first, then processes the sampled packets into flows. It works best if you can ensure that the sampling process doesn't introduce bias. A "Poisson" sampling process is generally preferable to e.g. fixed-rate (systematic) sampling. > I am assuming there is a great deal more involved in this, has > anyone already "done the math" here? Lots, for example N. Duffield, Sampling for passive internet measurement: A review, 2004 N. Duffield, C. Lund, Predicting resource usage and estimation accuracy in an IP flow measurement collection infrastructure, IMC 2003 (copies can be found using your favorite search engine.) -- Simon. _______________________________________________ Flow-tools mailing list [email protected] http://mailman.splintered.net/mailman/listinfo/flow-tools
