Impact of Packet Sampling on Link Dimensioning

Abstract

Link dimensioning is used by network operators to properly provision the capacity of their network links. Proposed methods for link dimensioning often require statistics, such as traffic variance, that need to be calculated from packet-level measurements. In practice, due to increasing traffic volume, operators deploy packet sampling techniques aiming to reduce the burden of traffic monitoring, but little is known about how link dimensioning is affected by such measurements. In this paper, we make use of a previously proposed and validated dimensioning formula that requires traffic variance to estimate required link capacity. We assess the impact of three packet sampling techniques on link dimensioning, namely, Bernoulli, n-in-N and sFlow sampling. To account for the additional variance introduced by the sampling algorithms, we propose approaches to better estimate traffic variance from sampled data according to the employed technique. Results show that, depending on sampling rate and link load, packet sampling does not negatively impact on link dimensioning accuracy even at very short timescales such as 10 ms. Moreover, we also show that the loss of inter-arrival time of sampled packets due to the exporting process in sFlow does not harm the estimations, given that an appropriate sampling rate is used. Our study is validated using a large dataset consisting of traffic packet traces captured at several locations around the globe.

Internet Traffic Volumes are Not Gaussian—They are Log-Normal: An 18-Year Longitudinal Study With Implications for Modelling and Prediction

“…For very small values of T , i.e. lower than 1 msec, data samples exhibit binary behaviour, where either a packet is transmitted or not during each examined time frame [23]. We have examined γ for very short (and large) aggregation timescales, and can confirm the absence of a model describing the data (for brevity, we have omitted the relevant figures).…”

“…The underlying fundamental assumption for this to work is that the traffic the network operator sees follows a Gaussian distribution. Same approach has been used in [23].…”

“…Identifying the log-normal distribution as the best fit for the vast majority of traffic traces at T = 100 msec is very encouraging. This specific traffic aggregation timescale has been commonly studied in the literature [18], [19].…”

“…This is therefore an excellent area for applying our findings on fitting the log-normal distribution to Internet traffic data. In the literature, the following inequality (the authors call it the "link transparency formula") has been used for bandwidth provisioning [19]:…”

On the Distribution of Traffic Volumes in the Internet and its Implications

“…Identifying the log-normal distribution as the best fit for the vast majority of traffic traces at T = 100 msec is very encouraging. This specific traffic aggregation timescale has been commonly studied in the literature [17], [18]. Next we investigate what the best model is for a range of aggregation timescales.…”