Fast monitoring of traffic subpopulations

Anirudh Ramachandran, Srinivasan Seetharaman, Nick Feamster, Vijay Vazirani

Research output: Chapter in Book/Report/Conference proceedingConference contribution

50 Scopus citations


Network accounting, forensics, security, and performance monitoring applications often need to examine detailed traces from subsets of flows ("subpopulations"), where the application requires flexibility in specifying the subpopulation (e.g., to detect a portscan, the application must observe many packets between a source and a destination with one packet to each port). Unfortunately, the dynamism and volume of network traffic on many high-speed links requires traffic sampling, which adversely affects subpopulation monitoring: because many subpopulations of interest to operators are low-volume flows, conventional sampling schemes (e.g., uniform random sampling) can miss much of the subpopulation's traffic. Today's routers and network devices provide scant support for monitoring specific traffic subpopulations. This paper presents the design, implementation, and evaluation of FlexSample, a traffic monitoring framework that dynamically extracts traffic from subpopulations that operators define using conditions on packet header fields. FlexSample uses a fast, flexible counter array to provide rough estimates of packets' membership in respective subpopulations. Based on these coarse estimates, FlexSample then makes per-packet sampling decisions to sample proportionately from each subpopulation (as specified by a network operator), subject to an overall sampling constraint. We apply FlexSample to extract subpopulations such as port scans and traffic to high-degree nodes and find that it can capture significantly more packets from these subpopulations than conventional approaches.

Original languageEnglish (US)
Title of host publicationIMC'08
Subtitle of host publicationProceedings of the 2008 ACM SIGCOMM Internet Measurement Conference
Number of pages14
StatePublished - 2008
EventInternet Measurement Conference 2008, IMC'08 - Vouliagmeni, Greece
Duration: Oct 20 2008Oct 22 2008

Publication series

NameProceedings of the ACM SIGCOMM Internet Measurement Conference, IMC


OtherInternet Measurement Conference 2008, IMC'08

All Science Journal Classification (ASJC) codes

  • Software
  • Computer Networks and Communications


  • Counters
  • Flexsample
  • Sampling
  • Traffic statistics
  • Traffic subpopulations


Dive into the research topics of 'Fast monitoring of traffic subpopulations'. Together they form a unique fingerprint.

Cite this