Trajectory Sampling: White Paper
Nick G. Duffield, Matthias Grossglauser · 2003
Trajectory Sampling (TS) is a novel method to measure network traffic in potentially large network domains [7]. It is designed to provide detailed views of network traffic that can drive a wide variety of network engineering and management applications, such as traffic reporting and characterization, attack and intrusion detection and diagnosis, traffic engineering, and capacity planning. TS implements consistent packet sampling. Conceptually, each packet traversing a measurement domain is sampled either on every link traversed, or on no link at all. Some highly compressed information on sampled packets are collected centrally in a collection system, which is then able to reconstruct the trajectory (path) of each sampled packet [5]. This set of sampled packet trajectories provides a complete and statistically representative view of the flow of traffic through the domain. A wide range of applicationspecific metrics and derived views (such as traffic matrices for traffic engineering or sink trees for a DDoS attack) can be inferred from this raw trajectory information. The main advantages of trajectory sampling are: • General and flexible: TS measurements are sufficiently fine-grained that a wide spectrum of applicationdependent metrics of interest can be derived from them. These range from simple aggregate characterizations (e.g., the distribution of packet sizes or source addresses over all the packets traversing