Evaluation of Hash Functions for Multipoint Sampling in IP Networks

Diploma Thesis from the year 2008 in the subject Computer Science - Applied, grade: 1, Technical University of Berlin, language: English, abstract: Network Measurements play an essential role in operating and developing todays Internet. A variety of measurement applications demand for multipoint network measurements, e.g. service providers need to validate their delay guarantees from Service Level Agreements and network engineers have incentives to track where packets are changed, reordered, lost or delayed. Multipoint measurements create an immense amount of measurement data which demands for high resource measurement infrastructure. Data selection techniques, like sampling and filtering, provide efficient solutions for reducing resource consumption while still maintaining sufficient information about the metrics of interest. But not all selection techniques are suitable for multipoint measurements; only deterministic filtering allows a synchronized selection of packets at multiple observation points. Nevertheless a fillter bases its selection decision on the packet content and hence is suspect to bias, i.e the selected subset is not representative for the whole population. Hash-based selection is a filtering method that tries to emulate random selection in order to obtain a representative sample for accurate estimations of traffic characteristics. The subject of the thesis is to assess which hash function and which packet content should be used for hash-based selection to obtain a seemingly random and unbiased selection of packets. This thesis empirically analyzes 25 hash functions and different packet content combinations on their suitability for hash-based selection. Experiments are based on a collection of 7 real traffic groups from different networks.