Double sampling for flow measurement on high speed links

Traffic measurement and monitoring are an important component of network QoS management and traffic engineering. With high speed Internet links, efficient and effective packet sampling techniques for traffic measurement are not only desirable, but increasingly becoming a necessity. Packet sampling has become an attractive and scalable means to measure flow data on high speed links. Passive traffic measurement increasingly employs sampling at the packet level and makes inferences from sampled network traffic. However, it meets difficulty in estimating the original flow distribution. To circumvent the problem, we propose and analyze a double sampling technique for flow measurement. In particular, we rewrite the expectation maximization (EM) algorithm that estimates flow distribution for double sampling. Using real network traffic traces, we show that the proposed double sampling technique indeed produces the desired accuracy in estimating the flow distribution.