Re: comments on draft-ietf-psamp-sample-tech-04.txt

[Maurizio Molina <molina@ccrle.nec.de>]

Benoit Claise wrote:

> Hi Maurizio,


> My point is that, if systematic time based sampling is implemented, 
> will you do it like 1. or 2.
> 1.    Case Systematic Time Based:        - Interval length (in usec), 
> Spacing (in usec)
> 2.    Case Systematic Time Based:        - Interval length (in usec), 
> Spacing (# packets)
>
> The option1 has got the big drawback that we have no idea how many 
> packets will be inspected and as a consequence we don't know what are 
> the bandwidth requirement for the export link(s). And if we do 
> sampling, it's typically because we have a bottleneck on the export 
> link(s) bandwidth or on the collector side...
Benoit,
I'm not 100% sure I understand what type of sampling you're speaking for 
or against.
However, in your upper sentence you say with Systematic Count based 
sampling (which includes 1 out of N), you don't have firm limits on the 
exported bandwidth.
That's true, but this type of sampling (*) allows you to estimate the 
rate of  the link. With Systematic Time based you cannot see any rate 
variation on the link because you always export a packet each T sec. 
(actually, you can only understand if the rate drops below 1/T) .
So, Systematic Time based can be useful for a lot of applications (e.g. 
random packet content inspection), but not for understanding the 
dynamics on a link.
Maurizio.

(*) and probabilistic sampling as well



--
to unsubscribe send a message to psamp-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/psamp/>