[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: psamp vocabulary

Rae McLellan wrote:
Except for one case, I don't believe applying the selectors in any
particular order produces different results.  Though early out for
performance might be something a compiler could achieve, the end
result of sampled traffic remains the same.  I don't really care
what syntax is used to specify the selectors or how they are combined.
But the functionality of union and conjunctions is important.
The only place where the order of the selector rules matters is
when performing the "sample K packets every N" type selector.
This is because there is a difference in the range over which
the N is sampled.  If this type of sampler is applied first, N
ranges over the entire input stream.  But if it is applied last,
then N only applies to those packets that have managed to pass
through any previous selector functions.  Each will produce a
different sample stream.
I think it is not true that in most cases the sequence in which
selectors are applied does not matter. If you perform any random
sampling and then run any deterministic function on the subset you will
always have different packets in the sample than you would get if you
applied the selectors in the reverse sequence.

oops, you're entirely right.  Its not the just the "sample K packets
every N" type selector, but also the random ones in the third group
I believe this is not correct. With random sampling the order does not matter. You get the same distribution of packets in the trace if you take all packets that match a filter and then keep each with probability p as when you throw away all packets with probability 1-p and then of the ones you didn't throw away, you keep the ones that match the filter.


that depend on order.  Its my fault, I've been deprecating random
sampling in favor of deterministic hash functions so much, that I'd
forgotten about that problem.  If psamp can eliminate this group
entirely, there would be no issue with selector ordering. (i think)
correct me, if I'm wrong.

	Rae McLellan

to unsubscribe send a message to psamp-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/psamp/>