An augmented two‐phase method for spread sampling

Abstract

Abstract Sampling is widely used to handle the mismatch between the line rate and the processing throughput of a traffic measurement module. Spread sampling, which only samples the elements in each flow when they appear for the first time and ignores them for subsequent appearances, is required for flow‐spread measurement. The previous works on spread sampling suffer from poor accuracy and slow speed. In this paper, the authors proposed an augmented two‐phase method with fast speed and low error to achieve spread sampling in that each distinct element is sampled with a predefined probability only at the first occurrence. The experiment results based on real Internet traffic traces show that our method achieves a smaller sampling error and a high line rate.