Estimating the number of active flows from sampled packets

A flow is active during a measurement period if it sends at least one packet. It is essential to control resource consumption in network monitoring by traffic sampling, so most high-end routers provide sampling network traffic function. The number of original flow is an important metrics to many network applications such as congestion control and network security. In this paper, we present a EUF algorithm that can accurately infer the number of original flow from the sampled packet traffic. Using the EUF algorithm, the number of unsampled flows can be estimated by an iteration method based on random sampling, and then the number of original flows can be precisely estimated according to both the number of the sampled flows and the unsampled flow. The EUF algorithm is also compared with the EM algorithm using multiple traffic traces collected from a Tier-1 ISP backbone networks. The result shows that the EUF algorithm is superior to EM and can provide highly accurate estimation on the number of the original flow.