An augmented two‐phase method for spread sampling

Abstract

Sampling is widely used to handle the mismatch between the line rate and the processing throughput of a traffic measurement module. Spread sampling, which only samples the elements in each flow when they appear for the first time and ignores them for subsequent appearances, is required for flow-spread measurement. The previous works on spread sampling suffer from poor accuracy and slow speed. In this paper, the authors proposed an augmented two-phase method with fast speed and low error to achieve spread sampling in that each distinct element is sampled with a predefined probability only at the first occurrence. The experiment results based on real Internet traffic traces show that our method achieves a smaller sampling error and a high line rate.