Estimating flow distribution by using difference information of multiple packet samplings

Packet sampling is one of effective ways to reduce the overhead of the traffic measurement at high speed routers, in which the router collects only a part of whole traffic based on the probabilistic theory. Since the statistic information of uncollected packets may be lost, the accuracy of the statistic information of sampled traffic becomes degraded as the increase of the sampling interval. In this paper, we analyze the difference information from statistics obtained by multiple sub-samplings with different sampling interval in order to model the change in the number of packets of flow by packet sampling. We then propose a new method which improves the accuracy of the estimation of flow length distribution. We show that our method can estimate original flow length distributions accurately.