On the impact of sampling on traffic monitoring and analysis

Due to significant advances in transmission technology and to the corresponding increase of link rates, traffic sampling is becoming a normal way of operation in traffic monitoring. Given this trend, in this paper we aim to assess the impact of the sampling on a wide range of tasks which are typical of an operational network. We follow an experimental approach, exploiting passive analysis of network traffic flows, taking into account different sampling policies (e.g., systematic, uniform and stratified) and different sampling rates. To quantify the amount of degradation and bias that sampling introduces with respect to the unsampled traffic we use well-known statistical measures (i.e., Hellinger Distance, Fleiss Chi-Square). Unlike previous work, we consider a very large set of “features” (i.e., any kind of properties characterizing traffic flows, from packet size and inter-arrival time, to Round Trip Time, TCP congestion window size, number of out-of-order packets, etc.) which are typically exploited by a rather wide class of applications, such as traffic monitoring, analysis, accounting, and classification. Using three real traffic traces, representative of different operational networks, we find that (i) a significant degradation affects a wide number of features; (ii) the set of features less degraded is consistent across the three datasets; (iii) at the same time, some artifacts may arise, resulting in lower distortion scores at higher sampling rates, which are tied to both the specific metric, as well as the way in which the feature is computed (e.g., binning); (iv) no significant reduction of the estimation bias can be obtained by merely tweaking the sampling policy - which partly contrasts earlier observations concerning the better quality achievable with stratified sampling.