Fisher Information in Flow Size Distribution

key computational costs to show that router implementation is feasible. Our approach offers insights into numerous issues, including the notion of 'flow quality' for understanding the relative performance of methods, and how and when employing sequence numbers is beneficial. Our work is theoretical with some simulation support and case studies on Internet data. I. INTRODUCTION The distribution of flow size, that is the number of packets in a flow, is a useful metric for traffic modelling and management, and is important for security because of the role small flows play in attacks. As is now well known however, its estimation based on sampled data is problematic. Currently, sampling decisions in routers are made on a per-packet basis, with only sampled packets being subsequently assembled into (sampled) flows. Duffield et al. [1] were the first to point out that simple packet sampling strategies such as '1 in N ' periodic or i.i.d. (independent, identically distributed) packet sampling have severe limitations, in particular a strong flow length bias which allows the tail of the flow size distribution to be recovered, but dramatically obscures the details of small flows. They explored the use of TCP SYN packets to improve the resolution at the small flow end of the spectrum. Hohn et al. [2], [3] explored these difficulties further and pointed out that flow sampling, where the sampling decision is made directly on flows, resulting in all packets belonging to any sampled flows being collected, has enormous statistical advantages. However, flow sampling has not been pursued further nor found its way into routers, partly because it implies that lookups be performed on every packet, which is very resource intensive.