Home > Topics > Passive Monitoring > Load management in network monitoring > Traffic sampling

Traffic sampling

Traffic sampling is arguably the most widely accepted technique to cope with the high resource requirements imposed on network monitoring systems, and is currently under standardization by the PSAMP working group at the IETF. Duffield reviews in [Duffield, 2004] the extensive literature existing in this field.

The research on traffic sampling can be divided into two main groups. On the one hand, several works have focused on estimating general traffic properties (e.g., number and average length of flows [Duffield et al., 2002], flow size distributions [Duffield et al., 2003] [Hohn and Veitch, 2003], on identifying traffic of particular interest to network operators (e.g., elephant flows [Mori et al., 2004], top-k flows [Barakat et al., 2005] [Cohen et al., 2006] and on evaluating the impact of sampling on some applications (e.g., flow accounting [Zseby et al., 2008], anomaly detection [Mai et al., 2006] [Mai et al., 2006] [Brauckhoff et al., 2006] from sampled measurements collected using Sampled NetFlow and/or other methods.

On the other hand, other research works have proposed efficient sampling techniques to improve the accuracy of certain applications. Thus, these proposals usually require changes on the collection devices. For example, some techniques have concentrated on the detection of large flows in high-speed networks, which account for most Internet traffic [Feldmann et al., 1998] (e.g., sample-and-hold and multistage filters [Estan and Varghese, 2003], shared-state sampling [Raspall et al., 2006], while others have proposed sampling algorithms that can operate before (e.g., step sample-and-hold [Cohen et al., 2007]) or after aggregation (e.g., threshold sampling [Duffield et al., 2005] [Duffield et al., 2001]), priority sampling [Duffield et al., 2004] [Duffield et al., 2007]) to estimate the size of an arbitrary set of flows. Duffield and Grossglauer have also proposed a hash-based technique, called trajectory sampling [Duffield and Grossglauer, 2001], that allows different monitors to sample the same set of flows.

References

  • C. Barakat, G. Iannaccone and C. Diot. Ranking flows from sampled traffic. Proc. of ACM CoNEXT, 2005.
  • [conf-imc-BrauckhoffTWML06] bibtex
    D. Brauckhoff, B. Tellenbach, A. Wagner, M. May, and A. Lakhina, "Impact of packet sampling on anomaly detection metrics.," in Internet Measurement Conference, 2007-03-01 2006, pp. 159-164.
    @inproceedings{conf/imc/BrauckhoffTWML06, added-at = {2007-03-01T00:00:00.000+0100},
      author = {Brauckhoff, Daniela and Tellenbach, Bernhard and Wagner, Arno and May, Martin and Lakhina, Anukool},
      biburl = {http://www.bibsonomy.org/bibtex/25496167a5d680f6565f18e63d63297fa/dblp},
      booktitle = {Internet Measurement Conference},
      crossref = {conf/imc/2006},
      date = {2007-03-01},
      description = {dblp},
      editor = {Almeida, Jussara M. and Almeida, Virgílio A. F. and Barford, Paul},
      ee = {http://doi.acm.org/10.1145/1177080.1177101},
      interhash = {fe746908f4f47dce1673d30518a8a95c},
      intrahash = {5496167a5d680f6565f18e63d63297fa},
      isbn = {1-59593-561-4},
      keywords = {dblp},
      pages = {159-164},
      publisher = {ACM},
      timestamp = {2007-03-01T00:00:00.000+0100},
      title = {Impact of packet sampling on anomaly detection metrics.},
      url = {http://dblp.uni-trier.de/db/conf/imc/imc2006.html#BrauckhoffTWML06},
      year = 2006 }
  • [conf-conext-CohenGK06] bibtex
    E. Cohen, N. Grossaug, and H. Kaplan, "Processing top k queries from samples.," in CoNEXT, 2008-05-15 2006, p. 7.
    @inproceedings{conf/conext/CohenGK06, added-at = {2008-05-15T00:00:00.000+0200},
      author = {Cohen, Edith and Grossaug, Nadav and Kaplan, Haim},
      biburl = {http://www.bibsonomy.org/bibtex/2e69f325a7c59f518c40009275f874ae2/dblp},
      booktitle = {CoNEXT},
      crossref = {conf/conext/2006},
      date = {2008-05-15},
      description = {dblp},
      editor = {Diot, Christophe and Ammar, Mostafa H.},
      ee = {http://doi.acm.org/10.1145/1368436.1368446},
      interhash = {8103f4fe44f24a33996e115fb1f8d836},
      intrahash = {e69f325a7c59f518c40009275f874ae2},
      isbn = {1-59593-456-1},
      keywords = {dblp},
      pages = 7, publisher = {ACM},
      timestamp = {2008-05-15T00:00:00.000+0200},
      title = {Processing top k queries from samples.},
      url = {http://dblp.uni-trier.de/db/conf/conext/conext2006.html#CohenGK06},
      year = 2006 }
  • [conf-pods-CohenDKLT07] bibtex
    E. Cohen, N. G. Duffield, H. Kaplan, C. Lund, and M. Thorup, "Sketching unaggregated data streams for subpopulation-size queries.," in PODS, 2007-06-13 2007, pp. 253-262.
    @inproceedings{conf/pods/CohenDKLT07, added-at = {2007-06-13T00:00:00.000+0200},
      author = {Cohen, Edith and Duffield, Nick G. and Kaplan, Haim and Lund, Carsten and Thorup, Mikkel},
      biburl = {http://www.bibsonomy.org/bibtex/2eec608560850f8b52c02c78d12e1d93f/dblp},
      booktitle = {PODS},
      crossref = {conf/pods/2007},
      date = {2007-06-13},
      description = {dblp},
      editor = {Libkin, Leonid},
      ee = {http://doi.acm.org/10.1145/1265530.1265566},
      interhash = {aa1cbe352b726e92147ab93edbc989fb},
      intrahash = {eec608560850f8b52c02c78d12e1d93f},
      isbn = {978-1-59593-685-1},
      keywords = {dblp},
      pages = {253-262},
      publisher = {ACM},
      timestamp = {2007-06-13T00:00:00.000+0200},
      title = {Sketching unaggregated data streams for subpopulation-size queries.},
      url = {http://dblp.uni-trier.de/db/conf/pods/pods2007.html#CohenDKLT07},
      year = 2007 }
  • [conf-imw-DuffieldLT01] bibtex
    N. G. Duffield, C. Lund, and M. Thorup, "Charging from sampled network usage.," in Internet Measurement Workshop, 2005-02-24 2001, pp. 245-256.
    @inproceedings{conf/imw/DuffieldLT01, added-at = {2005-02-24T00:00:00.000+0100},
      author = {Duffield, Nick G. and Lund, Carsten and Thorup, Mikkel},
      biburl = {http://www.bibsonomy.org/bibtex/20aa6301c7872edc89da10aa9a87e2b74/dblp},
      booktitle = {Internet Measurement Workshop},
      crossref = {conf/imw/2001},
      date = {2005-02-24},
      description = {dblp},
      editor = {Paxson, Vern},
      ee = {http://doi.acm.org/10.1145/505202.505232},
      interhash = {e6ca0400af077f91ba851fca63e7044c},
      intrahash = {0aa6301c7872edc89da10aa9a87e2b74},
      isbn = {1-58113-435-5},
      keywords = {dblp},
      pages = {245-256},
      publisher = {ACM},
      timestamp = {2005-02-24T00:00:00.000+0100},
      title = {Charging from sampled network usage.},
      url = {http://dblp.uni-trier.de/db/conf/imw/imw2001.html#DuffieldLT01},
      year = 2001 }
  • [journals-ton-DuffieldG01] bibtex
    N. G. Duffield and M. Grossglauser, "Trajectory sampling for direct traffic observation.," IEEE/ACM Trans. Netw., vol. 9, iss. 3, pp. 280-292, 2001.
    @article{journals/ton/DuffieldG01, added-at = {2011-11-03T00:00:00.000+0100},
      author = {Duffield, Nick G. and Grossglauser, Matthias},
      biburl = {http://www.bibsonomy.org/bibtex/21d0245968977d4106c67b9fe561cf39b/dblp},
      ee = {http://dx.doi.org/10.1109/90.929851},
      interhash = {781dfa764c035609cd0c6486f5d16b36},
      intrahash = {1d0245968977d4106c67b9fe561cf39b},
      journal = {IEEE/ACM Trans. Netw.},
      keywords = {dblp},
      number = 3, pages = {280-292},
      timestamp = {2011-11-03T00:00:00.000+0100},
      title = {Trajectory sampling for direct traffic observation.},
      url = {http://dblp.uni-trier.de/db/journals/ton/ton9.html#DuffieldG01},
      volume = 9, year = 2001 }
  • [conf-imc-DuffieldLT02] bibtex
    N. G. Duffield, C. Lund, and M. Thorup, "Properties and prediction of flow statistics from sampled packet streams.," in Internet Measurement Workshop, 2006-02-15 2002, pp. 159-171.
    @inproceedings{conf/imc/DuffieldLT02, added-at = {2006-02-15T00:00:00.000+0100},
      author = {Duffield, Nick G. and Lund, Carsten and Thorup, Mikkel},
      biburl = {http://www.bibsonomy.org/bibtex/2e1d4382f832b84dc4b14bcbf23c18813/dblp},
      booktitle = {Internet Measurement Workshop},
      crossref = {conf/imc/2002},
      date = {2006-02-15},
      description = {dblp},
      ee = {http://doi.acm.org/10.1145/637201.637225},
      interhash = {7c337a97076cd5cd7b85ca2d922dcc17},
      intrahash = {e1d4382f832b84dc4b14bcbf23c18813},
      isbn = {1-58113-603-X},
      keywords = {dblp},
      pages = {159-171},
      publisher = {ACM},
      timestamp = {2006-02-15T00:00:00.000+0100},
      title = {Properties and prediction of flow statistics from sampled packet streams.},
      url = {http://dblp.uni-trier.de/db/conf/imc/imw2002.html#DuffieldLT02},
      year = 2002 }
  • [conf-sigcomm-DuffieldLT03] bibtex
    N. G. Duffield, C. Lund, and M. Thorup, "Estimating flow distributions from sampled flow statistics.," in SIGCOMM, 2006-02-15 2003, pp. 325-336.
    @inproceedings{conf/sigcomm/DuffieldLT03, added-at = {2006-02-15T00:00:00.000+0100},
      author = {Duffield, Nick G. and Lund, Carsten and Thorup, Mikkel},
      biburl = {http://www.bibsonomy.org/bibtex/25fee91c32dbc6984ce65d78683ec2d0f/dblp},
      booktitle = {SIGCOMM},
      crossref = {conf/sigcomm/2003},
      date = {2006-02-15},
      description = {dblp},
      editor = {Feldmann, Anja and Zitterbart, Martina and Crowcroft, Jon and Wetherall, David},
      ee = {http://doi.acm.org/10.1145/863955.863992},
      interhash = {65b6cf4956b79a2667f810b1fb5e6763},
      intrahash = {5fee91c32dbc6984ce65d78683ec2d0f},
      isbn = {1-58113-735-4},
      keywords = {dblp},
      pages = {325-336},
      publisher = {ACM},
      timestamp = {2006-02-15T00:00:00.000+0100},
      title = {Estimating flow distributions from sampled flow statistics.},
      url = {http://dblp.uni-trier.de/db/conf/sigcomm/sigcomm2003.html#DuffieldLT03},
      year = 2003 }
  • N. Duffield. Sampling for Passive Internet Measurement: A Review. Statistical Science, 19(3), 2004.
  • [conf-sigmetrics-DuffieldLT04] bibtex
    N. G. Duffield, C. Lund, and M. Thorup, "Flow sampling under hard resource constraints.," in SIGMETRICS, 2006-02-15 2004, pp. 85-96.
    @inproceedings{conf/sigmetrics/DuffieldLT04, added-at = {2006-02-15T00:00:00.000+0100},
      author = {Duffield, Nick G. and Lund, Carsten and Thorup, Mikkel},
      biburl = {http://www.bibsonomy.org/bibtex/2c8320f80801aeaddfa470a096ec5ce68/dblp},
      booktitle = {SIGMETRICS},
      crossref = {conf/sigmetrics/2004},
      date = {2006-02-15},
      description = {dblp},
      editor = {Jr., Edward G. Coffman and Liu, Zhen and Merchant, Arif},
      ee = {http://doi.acm.org/10.1145/1005686.1005699},
      interhash = {abc39e650c9f00bbfe86202f0252fe95},
      intrahash = {c8320f80801aeaddfa470a096ec5ce68},
      isbn = {1-58113-873-3},
      keywords = {dblp},
      pages = {85-96},
      publisher = {ACM},
      timestamp = {2006-02-15T00:00:00.000+0100},
      title = {Flow sampling under hard resource constraints.},
      url = {http://dblp.uni-trier.de/db/conf/sigmetrics/sigmetrics2004.html#DuffieldLT04},
      year = 2004 }
  • [journals-tit-DuffieldLT05] bibtex
    N. G. Duffield, C. Lund, and M. Thorup, "Learn more, sample less: control of volume and variance in network measurement.," IEEE Transactions on Information Theory, vol. 51, iss. 5, pp. 1756-1775, 2005.
    @article{journals/tit/DuffieldLT05, added-at = {2005-09-29T00:00:00.000+0200},
      author = {Duffield, Nick G. and Lund, Carsten and Thorup, Mikkel},
      biburl = {http://www.bibsonomy.org/bibtex/223b0f67aed7c6f8cafacddb77ec6ca1d/dblp},
      date = {2005-09-29},
      description = {dblp},
      ee = {http://dx.doi.org/10.1109/TIT.2005.846400},
      interhash = {bec6f77dc933803e658acd5a7cfed291},
      intrahash = {23b0f67aed7c6f8cafacddb77ec6ca1d},
      journal = {IEEE Transactions on Information Theory},
      keywords = {dblp},
      number = 5, pages = {1756-1775},
      timestamp = {2005-09-29T00:00:00.000+0200},
      title = {Learn more, sample less: control of volume and variance in network measurement.},
      url = {http://dblp.uni-trier.de/db/journals/tit/tit51.html#DuffieldLT05},
      volume = 51, year = 2005 }
  • [journals-jacm-DuffieldLT07] bibtex
    N. G. Duffield, C. Lund, and M. Thorup, "Priority sampling for estimation of arbitrary subset sums.," J. ACM, vol. 54, iss. 6, 2007.
    @article{journals/jacm/DuffieldLT07, added-at = {2007-12-10T00:00:00.000+0100},
      author = {Duffield, Nick G. and Lund, Carsten and Thorup, Mikkel},
      biburl = {http://www.bibsonomy.org/bibtex/2307b0625f9f26e8c2d093d10770f0bbf/dblp},
      date = {2007-12-10},
      description = {dblp},
      ee = {http://doi.acm.org/10.1145/1314690.1314696},
      interhash = {ba59aaf3a9eda6dc3a5dbef2e5930dd4},
      intrahash = {307b0625f9f26e8c2d093d10770f0bbf},
      journal = {J. ACM},
      keywords = {dblp},
      number = 6, timestamp = {2007-12-10T00:00:00.000+0100},
      title = {Priority sampling for estimation of arbitrary subset sums.},
      url = {http://dblp.uni-trier.de/db/journals/jacm/jacm54.html#DuffieldLT07},
      volume = 54, year = 2007 }
  • [journals-tocs-EstanV03] bibtex
    C. Estan and G. Varghese, "New directions in traffic measurement and accounting: Focusing on the elephants, ignoring the mice.," ACM Trans. Comput. Syst., vol. 21, iss. 3, pp. 270-313, 2003.
    @article{journals/tocs/EstanV03, added-at = {2003-11-24T00:00:00.000+0100},
      author = {Estan, Cristian and Varghese, George},
      biburl = {http://www.bibsonomy.org/bibtex/28af538b0303f07eed435878517b5e679/dblp},
      date = {2003-11-24},
      description = {dblp},
      ee = {http://doi.acm.org/10.1145/859716.859719},
      interhash = {17cb1f5c12627de6ac3bb49d285cae08},
      intrahash = {8af538b0303f07eed435878517b5e679},
      journal = {ACM Trans. Comput. Syst.},
      keywords = {dblp},
      number = 3, pages = {270-313},
      timestamp = {2003-11-24T00:00:00.000+0100},
      title = {New directions in traffic measurement and accounting: Focusing on the elephants, ignoring the mice.},
      url = {http://dblp.uni-trier.de/db/journals/tocs/tocs21.html#EstanV03},
      volume = 21, year = 2003 }
  • [journals-ton-FeldmannRC98] bibtex
    A. Feldmann, J. Rexford, and R. Cáceres, "Efficient policies for carrying Web traffic over flow-switched networks.," IEEE/ACM Trans. Netw., vol. 6, iss. 6, pp. 673-685, 1998.
    @article{journals/ton/FeldmannRC98, added-at = {2011-11-03T00:00:00.000+0100},
      author = {Feldmann, Anja and Rexford, Jennifer and Cáceres, Ramón},
      biburl = {http://www.bibsonomy.org/bibtex/2bfba0c85f145d64748e6f06142ccaffb/dblp},
      ee = {http://dx.doi.org/10.1109/90.748081},
      interhash = {6fffa61fa603dff0e0b45464b4fe5fe8},
      intrahash = {bfba0c85f145d64748e6f06142ccaffb},
      journal = {IEEE/ACM Trans. Netw.},
      keywords = {dblp},
      number = 6, pages = {673-685},
      timestamp = {2011-11-03T00:00:00.000+0100},
      title = {Efficient policies for carrying Web traffic over flow-switched networks.},
      url = {http://dblp.uni-trier.de/db/journals/ton/ton6.html#FeldmannRC98},
      volume = 6, year = 1998 }
  • [conf-imc-HohnV03] bibtex
    N. Hohn and D. Veitch, "Inverting sampled traffic.," in Internet Measurement Comference, 2006-02-15 2003, pp. 222-233.
    @inproceedings{conf/imc/HohnV03, added-at = {2006-02-15T00:00:00.000+0100},
      author = {Hohn, Nicolas and Veitch, Darryl},
      biburl = {http://www.bibsonomy.org/bibtex/2a27a71a89af70bf876139b059f648d86/dblp},
      booktitle = {Internet Measurement Comference},
      crossref = {conf/imc/2003},
      date = {2006-02-15},
      description = {dblp},
      ee = {http://doi.acm.org/10.1145/948205.948235},
      interhash = {9109483ee9486d4000924a6e154304d4},
      intrahash = {a27a71a89af70bf876139b059f648d86},
      isbn = {1-58113-773-7},
      keywords = {dblp},
      pages = {222-233},
      publisher = {ACM},
      timestamp = {2006-02-15T00:00:00.000+0100},
      title = {Inverting sampled traffic.},
      url = {http://dblp.uni-trier.de/db/conf/imc/imc2003.html#HohnV03},
      year = 2003 }
  • [conf-imc-MaiCSYZ06] bibtex
    J. Mai, C. Chuah, A. Sridharan, T. Ye, and H. Zang, "Is sampled data sufficient for anomaly detection?," in Internet Measurement Conference, 2007-03-01 2006, pp. 165-176.
    @inproceedings{conf/imc/MaiCSYZ06, added-at = {2007-03-01T00:00:00.000+0100},
      author = {Mai, Jianning and Chuah, Chen-Nee and Sridharan, Ashwin and Ye, Tao and Zang, Hui},
      biburl = {http://www.bibsonomy.org/bibtex/272e4c871f4bf74f23cf19b0a3d49135b/dblp},
      booktitle = {Internet Measurement Conference},
      crossref = {conf/imc/2006},
      date = {2007-03-01},
      description = {dblp},
      editor = {Almeida, Jussara M. and Almeida, Virgílio A. F. and Barford, Paul},
      ee = {http://doi.acm.org/10.1145/1177080.1177102},
      interhash = {731d302b09ecd24d3ed9c81499811fbc},
      intrahash = {72e4c871f4bf74f23cf19b0a3d49135b},
      isbn = {1-59593-561-4},
      keywords = {dblp},
      pages = {165-176},
      publisher = {ACM},
      timestamp = {2007-03-01T00:00:00.000+0100},
      title = {Is sampled data sufficient for anomaly detection?},
      url = {http://dblp.uni-trier.de/db/conf/imc/imc2006.html#MaiCSYZ06},
      year = 2006 }
  • [journals-jsac-MaiSCZY06] bibtex
    J. Mai, A. Sridharan, C. Chuah, H. Zang, and T. Ye, "Impact of Packet Sampling on Portscan Detection.," IEEE Journal on Selected Areas in Communications, vol. 24, iss. 12, pp. 2285-2298, 2006.
    @article{journals/jsac/MaiSCZY06, added-at = {2007-12-07T00:00:00.000+0100},
      author = {Mai, Jianning and Sridharan, Ashwin and Chuah, Chen-Nee and Zang, Hui and Ye, Tao},
      biburl = {http://www.bibsonomy.org/bibtex/2d1a48642215e93c96219bfc8397436d0/dblp},
      date = {2007-12-07},
      description = {dblp},
      ee = {http://doi.ieeecomputersociety.org/10.1109/JSAC.2006.884027},
      interhash = {9fa19c7e7aaeb508fd609e2d97066cd3},
      intrahash = {d1a48642215e93c96219bfc8397436d0},
      journal = {IEEE Journal on Selected Areas in Communications},
      keywords = {dblp},
      number = 12, pages = {2285-2298},
      timestamp = {2007-12-07T00:00:00.000+0100},
      title = {Impact of Packet Sampling on Portscan Detection.},
      url = {http://dblp.uni-trier.de/db/journals/jsac/jsac24.html#MaiSCZY06},
      volume = 24, year = 2006 }
  • [conf-imc-MoriUKPG04] bibtex
    T. Mori, M. Uchida, R. Kawahara, J. P. 0002, and S. Goto, "Identifying elephant flows through periodically sampled packets.," in Internet Measurement Conference, 2007-01-18 2004, pp. 115-120.
    @inproceedings{conf/imc/MoriUKPG04, added-at = {2007-01-18T00:00:00.000+0100},
      author = {Mori, Tatsuya and Uchida, Masato and Kawahara, Ryoichi and 0002, Jianping Pan and Goto, Shigeki},
      biburl = {http://www.bibsonomy.org/bibtex/2aaadab9a8ebca4cf44e9c14530dbdedf/dblp},
      booktitle = {Internet Measurement Conference},
      crossref = {conf/imc/2004},
      date = {2007-01-18},
      description = {dblp},
      editor = {Lombardo, Alfio and Kurose, James F.},
      ee = {http://doi.acm.org/10.1145/1028788.1028803},
      interhash = {c32ff56509e03fef23422b1f9e9a3bdd},
      intrahash = {aaadab9a8ebca4cf44e9c14530dbdedf},
      isbn = {1-58113-821-0},
      keywords = {dblp},
      pages = {115-120},
      publisher = {ACM},
      timestamp = {2007-01-18T00:00:00.000+0100},
      title = {Identifying elephant flows through periodically sampled packets.},
      url = {http://dblp.uni-trier.de/db/conf/imc/imc2004.html#MoriUKPG04},
      year = 2004 }
  • [conf-imc-RaspallSY06] bibtex
    F. Raspall, S. Sallent, and J. Yufera, "Shared-state sampling.," in Internet Measurement Conference, 2007-03-01 2006, pp. 1-14.
    @inproceedings{conf/imc/RaspallSY06, added-at = {2007-03-01T00:00:00.000+0100},
      author = {Raspall, Frederic and Sallent, Sebastià and Yufera, Josep},
      biburl = {http://www.bibsonomy.org/bibtex/26eee9f16375ded9ba3c9610801b93c57/dblp},
      booktitle = {Internet Measurement Conference},
      crossref = {conf/imc/2006},
      date = {2007-03-01},
      description = {dblp},
      editor = {Almeida, Jussara M. and Almeida, Virgílio A. F. and Barford, Paul},
      ee = {http://doi.acm.org/10.1145/1177080.1177082},
      interhash = {111f88db88f794e2f2cf6f2f08e60a18},
      intrahash = {6eee9f16375ded9ba3c9610801b93c57},
      isbn = {1-59593-561-4},
      keywords = {dblp},
      pages = {1-14},
      publisher = {ACM},
      timestamp = {2007-03-01T00:00:00.000+0100},
      title = {Shared-state sampling.},
      url = {http://dblp.uni-trier.de/db/conf/imc/imc2006.html#RaspallSY06},
      year = 2006 }
  • [conf-pam-ZsebyHC08] bibtex
    T. Zseby, T. Hirsch, and B. Claise, "Packet Sampling for Flow Accounting: Challenges and Limitations.," in PAM, 2008-05-13 2008, pp. 61-71.
    @inproceedings{conf/pam/ZsebyHC08, added-at = {2008-05-13T00:00:00.000+0200},
      author = {Zseby, Tanja and Hirsch, Thomas and Claise, Benoit},
      biburl = {http://www.bibsonomy.org/bibtex/21e63db032182b7a31bc935c68d2d98bd/dblp},
      booktitle = {PAM},
      crossref = {conf/pam/2008},
      date = {2008-05-13},
      description = {dblp},
      editor = {Claypool, Mark and Uhlig, Steve},
      ee = {http://dx.doi.org/10.1007/978-3-540-79232-1_7},
      interhash = {8a94f7fa7567a42aefca154022d0f457},
      intrahash = {1e63db032182b7a31bc935c68d2d98bd},
      isbn = {978-3-540-79231-4},
      keywords = {dblp},
      pages = {61-71},
      publisher = {Springer},
      series = {Lecture Notes in Computer Science},
      timestamp = {2008-05-13T00:00:00.000+0200},
      title = {Packet Sampling for Flow Accounting: Challenges and Limitations.},
      url = {http://dblp.uni-trier.de/db/conf/pam/pam2008.html#ZsebyHC08},
      volume = 4979, year = 2008 }