[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: psamp vocabulary
Rae McLellan wrote:
I believe this is not correct. With random sampling the order does not matter.
You get the same distribution of packets in the trace if you take all packets
that match a filter and then keep each with probability p as when you throw
away all packets with probability 1-p and then of the ones you didn't throw
away, you keep the ones that match the filter.
Except for one case, I don't believe applying the selectors in any
particular order produces different results. Though early out for
performance might be something a compiler could achieve, the end
result of sampled traffic remains the same. I don't really care
what syntax is used to specify the selectors or how they are combined.
But the functionality of union and conjunctions is important.
The only place where the order of the selector rules matters is
when performing the "sample K packets every N" type selector.
This is because there is a difference in the range over which
the N is sampled. If this type of sampler is applied first, N
ranges over the entire input stream. But if it is applied last,
then N only applies to those packets that have managed to pass
through any previous selector functions. Each will produce a
different sample stream.
I think it is not true that in most cases the sequence in which
selectors are applied does not matter. If you perform any random
sampling and then run any deterministic function on the subset you will
always have different packets in the sample than you would get if you
applied the selectors in the reverse sequence.
oops, you're entirely right. Its not the just the "sample K packets
every N" type selector, but also the random ones in the third group
that depend on order. Its my fault, I've been deprecating random
sampling in favor of deterministic hash functions so much, that I'd
forgotten about that problem. If psamp can eliminate this group
entirely, there would be no issue with selector ordering. (i think)
correct me, if I'm wrong.
to unsubscribe send a message to firstname.lastname@example.org with
the word 'unsubscribe' in a single line as the message text body.