Estimation of Flow Distributions from Sampled Traffic

Abstract

This work addresses the problem of estimating the distributions of packet flow sizes and durations under several methods of sampling packets. Two approaches, one based on inversion and the other on asymptotics, are considered. For the duration distribution, in particular, both approaches require modeling the structure of flows, with the duration distribution being characterized in terms of the IATs (interarrival times between packets) and size distributions of a flow. The inversion of the flow IAT distribution from sampled flow quantities, along with the inversion of the flow size distribution (already used in the literature) allows estimating the flow duration distribution. Motivated by the limitations of the inversion approach in estimating the distribution tails for some sampling methods, an asymptotic approach is developed to estimate directly the distribution tails of flow durations and sizes from sampled quantities. The adequacy of both approaches to estimate the flow distributions is checked against two real Internet traces.