[c-nsp] netflow sampling

[Roland Dobbins]

On May 20, 2009, at 4:08 AM, Marlon Duksa wrote:

> It looks to me that the accuracy of such approach is pretty bad.

To the contrary, it's quite good, and operationally useful.  The  
majority of NetFlow export on large, high-speed networks is sampled,  
due to the sheer speed/volume of traffic and concomitant level of  
hardware support from vendors; most commercial NetFlow collection/ 
analysis systems (full disclosure:  I work for a company in this  
field) understand and statistically smooth sampled NetFlow, and an  
increasing number of open-source tools do, as well (see recent  
discussion on this topic).

> How can you use this for any meaningful accounting, much less billing.


In the same way that sampling is used for all sorts of statistics and  
for all sorts of other purposes.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton