A key aspect of sFlow is that it provides quantitative measurements. sFlow has been specifically designed as part of a complete traffic monitoring solution. The overall system takes advantages of the statistical properties of packet sampling and can be modeled using statistical sampling theory. This means that the sFlow traffic monitoring system will always produce statistically quantifiable measurements.
The following documents describe the statistical models supporting sFlow and other experiences with using sampling to measure network traffic.
- Packet Sampling Basics P. Phaal and S. Panchen, 2002
- Traffic Estimation for the Largest Sources on a Network, Using Packet Sampling with Limited Storage Hewlett-Packard, 1992
- Properties and Prediction of Flow Statistics from Sampled Packet Streams N. Duffield, C. Lund and M. Thorup, 2002
- Identifying Elephant Flows
Through Periodically Sampled Packets
T. Mori, M. Uchida and
R. Kawahara, 2004
- Detecting Network Intrusions
via Sampling: A Game Theoretic Approach M. Kodialam
and T.V. Lakshman, 2003
- The Effect of Packet Sampling on Anomaly Detection D. Brauckhoff, B. Tellenbach, A. Wagner, A. Lakhina and M. May, 2006
- Application of sampling methodologies to wide-area network traffic characterization K. Claffy and H.-W. Braun, 1993
- Distilling the Internet's Application Mix from Packet-Sampled Traffic P. Richter, N. Chatzis, G. Smaragdakis, A. Feldmann, and W. Willinger, 2015
- sFlow Accuracy and Billing InMon Corp., 2001
