Network Traffic Sampling Model on Packet Identification

Spatially coordinated packet sampling can be implemented by using a deterministic function of packet content to determine the selection decision for a given packet. In this way, a given packet may be selected at either all points that it passes, or none. Selection amongst the set of packets should appear as random as possible. In this paper we calculate the empirical entropy of selection of bits from various fields from the packet header. Based on this study they propose using the IP identification field (IPID) to seed the selection decision. In order to sample at a given desired sampling rate, a mask is applied to the IPID, with selection occurring if the field matches a given value after masking. By applying a number of non-overlapping masks in succession, any rate within a given range can be specified. If the field contents were actually random, the long term sampling rate would be the ratio of ID value that survive the mask, to the total number of possible values. After researching and analyzing huge amounts of packet headers captured randomly on CERNET backbone, the result shows that 16 bits of identification field in IP packet header is enough for matching bits of sampling mask. Randomization and statistical attribute of the sampling are analyzed in the paper, and a multimask sampling model on the identification field can not only control sampling precise to 1/65536, but also use different sampling parameters among different measurement points. The randomicity and synchronization of sampled packets can be assured automatically, and both network traffic performance and statistical characters are analyzed.