Time-Out bloom filter: a new sampling method for recording more flows

Authors:
Shijin Kong;Tao He;Xiaoxin Shao;Changqing An;Xing Li
Affiliations:
Department of Electronic Engineering, Tsinghua University, Beijing, P.R China;China Education and Research Network (CERNET), Beijing, P.R China;Department of Electronic Engineering, Tsinghua University, Beijing, P.R China;China Education and Research Network (CERNET), Beijing, P.R China;China Education and Research Network (CERNET), Beijing, P.R China
Venue:
ICOIN'06 Proceedings of the 2006 international conference on Information Networking: advances in Data Communications and Wireless Networks
Year:
2006

Citing 12
Cited 2

Efficient policies for carrying Web traffic over flow-switched networks

IEEE/ACM Transactions on Networking (TON)
Space/time trade-offs in hash coding with allowable errors

Communications of the ACM
Trajectory sampling for direct traffic observation

IEEE/ACM Transactions on Networking (TON)
Charging from sampled network usage

IMW '01 Proceedings of the 1st ACM SIGCOMM Workshop on Internet Measurement
New directions in traffic measurement and accounting

Proceedings of the 2002 conference on Applications, technologies, architectures, and protocols for computer communications
Estimating flow distributions from sampled flow statistics

Proceedings of the 2003 conference on Applications, technologies, architectures, and protocols for computer communications
Predicting resource usage and estimation accuracy in an IP flow measurement collection infrastructure

Proceedings of the 3rd ACM SIGCOMM conference on Internet measurement
Inverting sampled traffic

Proceedings of the 3rd ACM SIGCOMM conference on Internet measurement
Building a better NetFlow

Proceedings of the 2004 conference on Applications, technologies, architectures, and protocols for computer communications
Transport layer identification of P2P traffic

Proceedings of the 4th ACM SIGCOMM conference on Internet measurement
On scalable attack detection in the network

Proceedings of the 4th ACM SIGCOMM conference on Internet measurement
On the difficulty of scalably detecting network attacks

Proceedings of the 11th ACM conference on Computer and communications security

A Space-Efficient Fair Packet Sampling Algorithm

APNOMS '08 Proceedings of the 11th Asia-Pacific Symposium on Network Operations and Management: Challenges for Next Generation Network Operations and Service Management
Hardware transactional memory for GPU architectures

Proceedings of the 44th Annual IEEE/ACM International Symposium on Microarchitecture

Quantified Score

Hi-index	0.00

Visualization

Abstract

Packet sampling is widely deployed to generate flow records on high speed links However, random sampling in which 1 in N packets is chosen suffers from omitting majority of flows, most of which are short flows (within N packets) Although usage-based applications work well by sampling long flows and neglecting short ones, there are many other applications which depend on nearly per-flow information In this paper, a novel sampling method is proposed to remedy the flow loss flaw We use a Time-out Bloom Filter to alleviate the sampling bias towards long flows Compared with random sampling, short flows have a much greater probability to be sampled while long flows are always sampled, but with much fewer sampled packets Experimental results show that, with the same sampling rate, our solution records several times more short flows than random sampling Particularly, up to 99% original flows can be retrieved Besides, we also propose an adaptive TBF system in fast SRAM to perform online sampling.