Sampling for passive Internet measurement: A review

Statistical Science

Volumn 19, Issue 3, 2004, Pages 472-498

  Duffield, Nick ^a  

^a AT AND T LABS RESEARCH   (United States)

Author keywords

Estimation; Flows; Network management; Packets; Sampling methods; Traffic measurement

Indexed keywords

EID: 16344383315     PISSN: 08834237     EISSN: None     Source Type: Journal    
DOI: 10.1214/088342304000000206     Document Type: Article

References (105)

1. ADAMS, A., BU, T., FRIEDMAN, T., HOROWITZ, J., TOWSLEY, D., CÁCERES, R., DUFFIELD, N. G., LO PRESTI, F., MOON, S. B. and PAXSON, V. (2000). The use of end-to-end multicast measurements for characterizing internal network behavior. IEEE Communications Magazine 38(5) 152-159. Available at www.research.att.com/~duffield/pubs/minc.ps.gz.
2. AMER, P. D. and CASSEL, L. N. (1989). Management of sampled real-time network measurements. In Proc. 14th IEEE Conference on Local Computer Networks 62-68. IEEE Press, New York.
3. APISDORF, J., CLAFFY, K., THOMPSON, K. and WILDER, R. (1996). OC3MON: Flexible, affordable, high performance statistics collection. Available at www.nlanr.net/NA/Oc3mon.
4. ARMITAGE, G. J. (2000). MPLS - The magic behind the myths. IEEE Communications Magazine 38(1) 124-131. Available at www.comsoc.org/ci/private/ 2000/jan/pdf/Armitage.pdf.
5. BARBARA, D., DUMOUCHEL, W., FALOUTSOS, C., HAAS, P. J., HELLERSTEIN, J. M., IOANNIDIS, Y., JAGADISH, H. V., JOHNSON, T., NG, R., POOSALA, V., ROSS, K. A. and SEVCIK, K. C. (1997). The New Jersey data reduction report. IEEE Data Engineering Bulletin 20(4) 3-42. Available at ftp://ftp.research.microsoft.com/ pub/debull/97DEC-CD.pdf.
6. BERNERS-LEE, T., FIELDING, R. and FRYSTYK, H. (1996). Hypertext transfer protocol - HTTP/1.0. RFC 1945. Available at www.ietf.org/rfc/rfc1945.txt.
7. BRODER, A. and MITZENMACHER, M. (2002). Network applications of Bloom filters: A survey. In Proc. Allerton Conference. Available at www.eecs.harvard.edu/~michaelm/NEWWORK/postscripts/BloomFilterSurvey.pdf.
8. CÁCERES, R., DUFFIELD, N. G., FELDMANN, A., FRIEDMANN, J., GREENBERG, A., GREER, R., JOHNSON, T., KALMANEK, C., KRISHNAMURTHY, B., LAVELLE, D., MISHRA, P. P., RAMAKRISHNAN, K. K., REXFORD, J., TRUE, F. and VAN DER MERWE, J. E. (2000). Measurement and analysis of IP network usage and behavior. IEEE Communications Magazine 38(5) 144-151. Available at www.research.att.com/ ~duffield/pubs/measure.ps.gz.
9. CASE, J., FEDOR, M., SCHOFFSTALL, M. and DAVIN, J. (1990). A simple network management protocol (SNMP). RFC 1157. Available at www.ietf.org/rfc/ rfc1157.txt.
10. CHAUDHURI, S., MOTWANI, R. and NARASAYYA, V. R. (1999). On random sampling over joins. In Proc. ACM SIGMOD 1999 263-274. ACM Press, New York. Available at doi.acm.org/10.1145/304182.304206.
11. CHOI, B.-Y., PARK, J. and ZHANG, Z.-L. (2002), Adaptive random sampling for load change detection (extended abstract). In Proc. ACM SIGMETRICS 2002 272-273. ACM Press, New York. Available at parapet.ee.princeton.edu/~sigm2002/ papers/p272-choi.pdf.
12. Cisco NetFlow. Available at www.cisco.com/warp/public/732/netflow/index. html.
13. Cisco NetFlow services and applications customer profiles. Available at www.cisco.com/warp/public/cc/pd/iosw/ioft/neflct/profiles/.
14. CLAFFY, K. C., BRAUN, H.-W. and POLYZOS, G. C. (1995). A parameterizable methodology for Internet traffic flow profiling. IEEE J. Selected Areas in Communications 13 1481-1494. Available at www.nlanr.net/Flowsresearch/ Flowspaper/flows.html.
15. CLAFFY, K. C., POLYZOS, G. C. and BRAUN, H.-W. (1993). Application of sampling methodologies to network traffic characterization, Computer Communication Review 23 194-203. Also appeared in Proc. ACM SIGCOMM 1993. Available at www.caida.org/outreach/papers/1993/asmw/sigcomm.sampling.pdf.
16. CLAFFY, K. C., POLYZOS, G. C. and BRAUN, H.-W. (1993). Application of sampling methodologies to network traffic characterization, Computer Communication Review 23 194-203. Also appeared in Proc. ACM SIGCOMM 1993. Available at www.caida.org/outreach/papers/1993/asmw/sigcomm.sampling.pdf.
17. COATES, A., HERO, A., NOWAK, R. and YU, B. (2002). Internet tomography. IEEE Signal Processing Magazine 19(3) 47-65. Available at www.ece.mcgill.ca/ ~coates/publications/tomoreview.ps.gz.
18. COCHRAN, W. (1977). Sampling Techniques, 3rd ed. Wiley, New York.
19. CORBATÓ, S. (1996). Backbone performance analysis techniques. In Proc. INET 96. Available at www.isoc.org/inet96/proceedings/d3/d3_1.htm.
20. CORMODE, G. and MUTHUKRISHNAN, S. (2004). What's new: Finding significant differences in network data streams. In Proc. IEEE INFOCOM 2004 3 1534-1545. IEEE Press, New York.
21. COZZANI, I. and GIORDANO, S. (1998). Traffic sampling methods for end-to-end QoS evaluation in large heterogeneous networks. Computer Networks and ISDN Systems 30 1697-1706. Available at netserv.iet.unipi.it/students/cozzani/ cozzani/Papers/TNC98.ps.gz.
22. CRANOR, C., GAO, Y., JOHNSON, T., SHKAPENYUK, V. and SPATSCHECK, O. (2002). Gigascope: High performance network monitoring with an SQL interface. Demonstration. In Proc. ACM SIGMOD 2002 623. Available at athos.rutgers.edu/ ~muthu/demo_02.pdf.
23. DEAN, D., FRANKLIN, M. and STUBBLEFIELD, A. (2001). An algebraic approach to IP traceback. In Proc. Network and Distributed System Security Symposium. Available at www.isoc.org/isoc/conferences/ndss/01/2001/papers/dean01.pdf.
24. DEMAINE, E., LÓPEZ-ORTIZ, A. and MUNRO, J. I. (2002). Frequency estimation of internet packet streams with limited space. Proc. 10th European Symposium on Algorithms. Lecture Notes in Comput. Sci. 2461 348-360. Available at theory.lcs.mit.edu/~edemaine/papers/NetworkStats_ESA2002/paper.pdf.
25. DROBISZ, J. and CHRISTENSEN, K. (1998). Adaptive sampling methods to determine traffic statistics including the Hurst parameter. In Proc. 23rd IEEE Conference on Local Computer Networks 238-247. IEEE Press, New York. Available at citeseer.ist.psu.edu/335773.html.
26. DUFFIELD, N. G., GERBER, A. and GROSSGLAUSER, M. (2002). Trajectory engine: A backend for trajectory sam pling. In IEEE Network Operations and Management Symposium 437-450. IEEE Press, New York. Available at www.research.att.com/~duffield/pubs/DGG01-engine.pdf.
27. DUFFIELD, N. G. and GROSSGLAUSER, M. (2001). Trajectory sampling for direct traffic observation. IEEE/ACM Transactions on Networking 9 280-292.
28. An abridged version appeared in Proc. ACM SIGCOMM 2000 271-282. Available at www.research.att.com/~duffield/pubs/DG-TS-ToN.pdf.
29. DUFFIELD, N. G. and LUND, C. (2003). Predicting resource usage and estimation accuracy in an IP flow measurement collection infrastructure. In Proc. ACM SIGCOMM Internet Measurement Conference 179-191. ACM Press, New York. Available at www.research.att.com/~duffield/pubs/p313-duffield-lund.pdf.
30. DUFFIELD, N. G., LUND, C. and THORUP, M. (2001). Charging from sampled network usage. In Proc. ACM SIGCOMM Internet Measurement Workshop 245-256. ACM Press, New York. Available at www.research.att.com/~duffield/pubs/DLT01-usage. pdf.
31. DUFFIELD, N. G., LUND, C. and THORUP, M. (2001). Learn more, sample less: Control of volume and variance in network measurement. Unpublished manuscript. Available at www.research.att.com/~duffield/pubs/DLT05-optimal.pdf.
32. DUFFIELD, N. G., LUND, C. and THORUP, M. (2002). Properties and prediction of flow statistics from sampled packet streams. In Proc. ACM SIGCOMM Internet Measurement Workshop 159-171. ACM Press, New York. Available at www.research.att.com/~duffield/pubs/DLT02-flows.pdf.
33. DUFFIELD, N. G., LUND, C. and THORUP, M. (2003). Estimating flow distributions from sampled flow statistics. In Proc. ACM SIGCOMM 2003 325-336. ACM Press, New York. Available at www.research.att.com/~duffield/pubs/DLT03- lengths.pdf.
34. DUFFIELD, N. G., LUND, C. and THORUP, M. (2004). Flow sampling under hard resource constraints. In Proc. ACM SIGMETRICS 2004 85-96. ACM Press, New York. Available at www.research.att.com/~duffield/pubs/DLT03-constrained.pdf.
35. DUMOUCHEL, W. (2002). Data squashing: Constructing summary data sets. In Handbook of Massive Data Sets (J. Abello, P. M. Pardalos and M. G. C. Resende, eds.) 579-591. Kluwer, Dordrecht.
36. DUMOUCHEL, W., VOLINKSY, C., JOHNSON, T., CORTES, C. and PREGIBON, D. (1999). Squashing flat files flatter. In Proc. Fifth ACM Conference on Knowledge Discovery and Data Mining 6-15. ACM Press, San Diego. Available at www.research.att.com/~corinna/papers/kddsquash.ps.gz.
37. DURAND, M. and FLAJOLET, P. (2003). Loglog counting of large cardinalities. Proc. 11th Annual European Symposium on Algorithms. Lecture Notes in Comput. Sci. 2832 605-617. Springer, Berlin.
38. ESTAN, C. and VARGHESE, G. (2003). New directions in traffic measurement and accounting: Focusing on the elephants, ignoring the mice. ACM Transactions on Computer Systems 21 270-313. Available at www.acm.org/sigcomm/ sigcomm2002papers/traffmeas.pdf.
39. ESTAN, C., VARGHESE, G. and FISK, M. (2003). Bitmap algorithms for counting active flows on high speed links. In Proc. ACM SIGCOMM Internet Measurement Conference 153-166. ACM Press, New York. Available at www.icir.org/vern/imc-2003/papers/p327-estan.ps.
40. FELDMANN, A., CÁCERES, R., DOUGLIS, F., GLASS, G. and RABINOVICH, M. (1999). Performance of Web proxy caching in heterogeneous bandwidth environments. In Proc. IEEE INFOCOM 1999 1 107-116. Available at www.research.att.com/~misha/network/proxim_full.ps.gz.
41. FELDMANN, A., GREENBERG, A., LUND, C., REINGOLD, N. and REXFORD, J. (2000). NetScope: Traffic engineering for IP networks. IEEE Network 14(2) 11-19. Available at www.cs.princeton.edu/~jrex/papers/ieeenet00.pdf.
42. FELDMANN, A., GREENBERG, A., LUND, C., REINGOLD, N., REXFORD, J. and TRUE, F. (2001). Deriving traffic demands for operational IP networks: Methodology and experience. IEEE/ACM Transactions on Networking 9 265-279. Available at www.cs.princeton.edu/~jrex/papers/ton01.pdf.
43. FELDMANN, A., REXFORD, J. and CÁCERES, R. (1998). Efficient policies for carrying web traffic over flow-switched networks. IEEE/ACM Transactions on Networking 6 673-685. Available at www.cs.princeton.edu/~jrex/ papers/ton98.ps.
44. FELDMEIER, D. C. (1986). Statistical monitors for local area networks. In Proc. 11th IEEE Conference on Local Computer Networks 142-146. IEEE Press, New York.
45. FIELDING, R., GETTYS, J., MOGUL, J., FRYSTYK, H., MASINTER, L., LEACH, P. and BERNERS-LEE, T. (1999). Hypertext transfer protocol - HTTP/1.1. RFC 2616. Available at www.ietf.org/rfc/rfc2616.txt.
46. FOUNDRY NETWORKS (2004). Foundry enterprise configuration and management guide. Appendix A. Remote network monitoring. Available at www.foundrynet.com/ services/documentation/ecmg/Net_Monitoring.html.
47. GIBBONS, P. B. and MATIAS, Y. (1998). New sampling-based summary statistics for improving approximate query answers. In Proc. ACM SIGMOD International Conference on Management of Data 331-342. ACM Press, New York. Available at citeseer.ist.psu.edu/gibbons98new.html.
48. GIBBONS, P. B. and MATIAS, Y. (1999). Synopsis data structures for massive data sets. In External Memory Algorithms (J. M. Abello and J. S. Vitter, eds.) 39-70. Amer. Math. Soc., Providence, RI. Available at www.math.tau.ac.il/~matias/papers/synopsis.ps.
49. GILBERT, A. C., KOTIDIS, Y., MUTHUKRISHNAN, S. and STRAUSS, M. J. (2001). QuickSAND: Quick summary and analysis of network data. Technical Report 2001-43, DIMACS. Available at www.math.lsa.umich.edu/~annacg/ps.files/ quickdimacstr.ps.
50. GOLAB, L., DEHAAN, D., DEMAINE, E., LOPEZ-ORTIZ, A. and MUNRO, J. (2003). Identifying frequent items in sliding windows over on-line packet streams. In Proc. ACM SIGCOMM Internet Measurement Conference 173-178. ACM Press, New York. Available at www.imconf.net/imc-2003/papers/p318-golab.pdf.
51. GROSSGLAUSER, M. and REXFORD, J. (2005). Passive traffic measurement for IP operations. In The In ternet as a Large-Scale Complex System (K. Park and W. Willinger, eds.). Oxford Univ. Press. Available at www.cs.princeton.edu/~jrex/ papers/sfi.pdf.
52. HERNANDEZ, E. A., CHIDESTER, M. C. and GEORGE, A. D. (2001). Adaptive sampling for network management. J. Network and Systems Management 9 409-434. Available at citeseer.nj.nec.com/544063.html.
53. HOHN, N. and VEITCH, D. (2003). Inverting sampled traffic. In Proc. ACM SIGCOMM Internet Measurement Conference 222-233. ACM Press, New York. Available at www.icir.org/vern/imc-2003/papers/thinning1.pdf.
54. HORVITZ, D. G. and THOMPSON, D. J. (1952). A generalization of sampling without replacement from a finite universe. J. Amer. Statist. Assoc. 47 663-685.
55. IETF. Packet sampling working group charter. Available at www.ietf.org/html.charters/psamp-charter.html.
56. IETF WORKING GROUP. Internet protocol flow information export (IPFIX). Available at net.doit.wisc.edu/ipfix/.
57. INMON CORPORATION (2004). sFlow accuracy and billing. Available at www.inmon.com/pdf/sFlowBilling.pdf.
58. INTERNATIONAL ORGANIZATION FOR STANDARDIZATION (1984). ISO information processing systems - data communication high-level data link control procedure frame structure. Report IS 3309, 3rd ed., ISO.
59. JACOBSON, V., LERES, C. and MCCANNE, S. (1989). tcp-dump. Available at ftp://ftp.ee.lbl.gov/tcpdump.tar.Z.
60. JEDWAB, J., PHAAL, P. and PINNA, B. (1992). Traffic estimation for the largest sources on a network, using packet sampling with limited storage. Technical Report 92-35, Hewlett-Packard Laboratories, Bristol. Available at www.hpl.hp.com/techreports/92/HPL-92-35.html.
61. JUNIPER NETWORKS. Configure traffic sampling. Available at www.juniper.net/techpubs/software/junos/junos63/swconfig63-policy/html/ sampling-config4.html.
62. KNUTH, D. E. (1998). The Art of Computer Programming 3, 3rd ed. Addison-Wesley, Reading, MA.
63. KODIALAM, M. and LAKSHMAN, T. V. (2003). Detecting network intrusions via sampling: A game theoretic approach. In Proc. IEEE INFOCOM 2003 3 1880-1889. IEEE Press, New York. Available at www.ieee-infocom.org/2003/papers/46_02.PDF.
64. KODIALAM, M., LAKSHMAN, T. V. and MOHANTY, S. (2004). Runs based traffic estimator (RATE): A simple, memory efficient scheme for per-flow rate estimation. In Proc. IEEE INFOCOM 2004 3 1808-1818. IEEE Press, New York.
65. KRISHNAIAH, P. R. and RAO, C. R., eds. (1988). Sampling. Handbook of Statistics 6. North-Holland, Amsterdam.
66. KUMAR, A., Xu, J., WANG, J., SPATSCHEK, O. and LI, L. (2004). Space-code Bloom filter for efficient per-flow traffic measurement. In Proc. IEEE INFOCOM 2004 3 1762-1773. IEEE Press, New York.
67. L'ECUYER, P. (1988). Efficient and portable combined random number generators. Communications of the ACM 31 742-751. Available at doi.acm.org/10.1145/62959.62969.
68. LEE, W. Readings in intrusion detection (online bibliography). Available at www.cc.gatech.edu/~wenke/ids-readings.html.
69. LELAND, W. E., TAQQU, M. S., WILLINGER, W. and WILSON, D. V. (1994). On the self-similar nature of Ethernet traffic. IEEE/ACM Transactions on Networking 2 1-15. Available at dx.doi.org/10.1109/90.282603.
70. LEVEL 3 COMMUNICATIONS, INC. (2000). Level 3 promises huge savings. Discount Long Distance Digest. August 2000. Available at www.thedigest.com/more/ 119/119-73.html.
71. MADIGAN, D., RAGHAVAN, N., DUMOUCHEL, W., NASON, M., POSSE, C. and RIDGEWAY, G. (2000). Likelihood-based data squashing: A modeling approach to instance construction. Technical report, AT&T Labs. Available at www.stat.rutgers.edu/~madigan/PAPERS/lds.pdf.
72. MANKU, G. S. and MOTWANI, R. (2002). Approximate frequency counts over data streams. In Proc. 28th International Conference on Very Large Data Bases. Available at www-db.stanford.edu/~manku/papers/02vldb-freq.pdf.
73. MATHIS, M. and MAHDAVI, J. (1996). Diagnosing Internet congestion with a transport layer performance tool. In Proc. INET 96. Available at www.isoc.org/inet96/proceedings/d3/d3_2.htm.
74. MICHEEL, J., BRAUN, H.-W. and GRAHAM, I. (2001). Storage and bandwidth requirements for passive Internet header traces. In Proc. Workshop on Network-Related Data Management. Available at wand.cs.waikato.ac.nz/pubs/6/pdf/ nrdm2001.pdf.
75. MOON, S. B. and ROSCOE, T. (2001). Metadata management of terabyte datasets from an IP backbone network: Experience and challenges. In Proc. Workshop on Network-Related Data Management. Available at berkeley. intel-research.net/troscoe/pubs/NRDM2001.pdf.
76. MOORE, D., PAXSON, V., SAVAGE, S., SHANNON, C., STANIFORD, S. and WEAVER, N. (2003). The spread of the sapphire/slammer worm. Technical report, CAIDA. Available at www.caida.org/outreach/papers/2003/sapphire/sapphire.html.
77. OWEN, A. (2000). Data squashing by empirical likelihood. Technical report, Dept. Statistics, Stanford Univ. Available at www-stat.stanford.edu/ ~owen/reports/squash.ps.
78. PAXSON, V. (1994). Empirically-derived analytic models of wide-area TCP connections. IEEE/ACM Transactions on Networking 2 316-336. Available at ftp://ftp.ee.lbl.gov/papers/WAN-TCP-models.ps.gz.
79. PAXSON, V. (1997). End-to-end routing behavior in the Internet. IEEE/ACM Transactions on Networking 5 601-615. Available at ftp://ftp.ee.lbl.gov/papers/ vp-routing-TON.ps.gz.
80. PAXSON, V., ALMES, G., MAHDAVI, J. and MATHIS, M. (1998). Framework for IP performance metrics. RFC 2330. Available at www.ietf.org/rfc/rfc2330.txt.
81. PEDERSON, S. and JOHNSON, M. (1990). Estimating model discrepancy. Technometrics 32 305-314.
82. PHAAL, P., PANCHEN, S. and MCKEE, N. (2001). InMon corporation's sFlow: A method for monitoring traffic in switched and routed networks. RFC 3176. Available at www.ietf.org/rfc/rfc3176.txt.
83. POSTEL, J. (1980). User datagram protocol. RFC 768. Available at www.ietf.org/rfc/rfc768.txt.
84. POSTEL, J. (1981). Internet protocol. RFC 791. Available at www.ietf.org/rfc/rfc791.txt.
85. POSTEL, J. (1981). Transmission control protocol. RFC 793. Available at www.ietf.org/rfc/rfc793.txt.
86. QOSIENT, Argus. Available at www.qosient.com/argus/index.htm.
87. Random sampled NetFlow. Available at www.cisco.com/en/US/products/sw/ iosswrel/ps5207/products_feature_guide09186a00801a7618.html#16984.
88. REEVES, J. and PANCHEN, S. (2002). Traffic monitoring with packet-based sampling for defense against security threats. In Proc. Passive and Active Measurement Workshop. Available at www.sflow.org/SamplingforSecurity.pdf.
89. REYNOLDS, J., ed. (2002). Assigned numbers: RFC 1700 is replaced by an on-line database. RFC 3232. Available at www.ietf.org/rfc/rfc3232.txt.
90. RIVERSTONE NETWORKS, INC. Available at www.riverstonenet.com/.
91. RIVEST, R. (1992). The MD5 message-digest algorithm. RFC 1321. Available at www.ietf.org/rfc/rfc1321.txt.
92. SAVAGE, S., WETHERALL, D., KARLIN, A. and ANDERSON, T. (2000). Practical network support for IP traceback. In Proc. ACM SIGCOMM 2000 295-306. Available at www.acm.org/sigcomm/sigcomm2000/conf/paper/sigcomm2000-8-4.ps.gz.
93. SCHERVISH, M. J. (1995). Theory of Statistics. Springer, New York.
94. SNOEREN, A. C., PARTRIDGE, C., SANCHEZ, L. A., JONES, C. E., TCHAKOUNTIO, F., KENT, S. T. and STRAYER, W. T. (2001). Hash-based IP traceback. In Proc. ACM SIGCOMM 2001 3-14, Available at www.acm.org/sigcomm/sigcomm2001/p1-snoeren. pdf.
95. SONG, D. and PERRIG, A. (2001). Advanced and authenticated marking schemes for IP traceback. In Proc. IEEE INFOCOM 20012 878-886. IEEE Press, New York. Available at www.ieee-infocom.org/2001/paper/476.ps.
96. TAYLOR, C. and ALVES-Foss, J. (2001). NATE: Network analysis of anomalous traffic events, a low-cost approach. In Proc. 2001 Workshop on New Security Paradigms 89-96. ACM Press, New York. Available at doi.acm.org/10.1145/508171. 508186.
97. THOMPSON, S. K. and SEBER, G. A. F. (1996). Adaptive Sampling. Wiley, New York.
98. VARDI, Y. (1996). Network tomography: Estimating source-destination traffic intensities from link data. J. Amer. Statist. Assoc. 91 365-377.
99. VITTER, J. S. (1985). Random sampling with a reservoir. ACM Trans. Math. Software 11 37-57. Available at doi.acm.org/10.1145/3147.3165.
100. WALDBUSSER, S. (2000). Remote network monitoring management information base. RFC 2819. Available at www.ietf.org/rfc/rfc2819.txt.
101. WinDump-tcpdump for Windows. Available at windump.polito.it/.
102. WOLFF, R. (1982). Poisson arrivals see time averages. Oper. Res. 30 223-231.
103. XACCT TECHNOLOGIES, INC. Available at www. amdocs.com.
104. ZHANG, Y., DUFFIELD, N. G., PAXSON, V. and SHENKER, S. (2001). On the constancy of Internet path properties. In Proc. ACM SIGCOMM Workshop on Internet Measurement 197-211. ACM Press, New York. Available at www.cs.utexas.edu/users/ yzhang/papers/constancy-imw01.pdf.
105. ZSEBY, T. (2002). Deployment of sampling methods for SLA validation with non-intrusive measurements. In Proc. Passive and Active Measurement Workshop. Available at www.labs.agilent.com/hosted/conferences/pam2002/proceedings/ Deployment_of_Sampling_Methods_for_SLA_Validation.pdf.