Sampling and its impact on Flowmon

Flowmon provides network visibility through flow-based monitoring (NetFlow/IPFIX/sFlow), offering:

• Traffic monitoring and reporting
• Network analysis
• Anomaly detection

The system includes:

• Optional Probes for accurate flow statistics in high-performance networks
• Collector for storing and visualizing traffic data
• Additional modules:
  • Flowmon ADS for network behavior analysis and security monitoring
  • Flowmon APM for agent-less application performance monitoring
  • Flowmon Traffic Recorder for on-demand packet capture

Sampling methods

Packet-level sampling

In ISP and datacenter environments, routers often use packet-level sampling when generating flows. This method:

• Samples a subset of packets during flow generation
• Changes the original network traffic characteristics

Flow-level sampling

Flow-level sampling:

• Measures traffic at full resolution (1:1)
• Only exports/processes a limited number of flows
• Preserves original traffic characteristics

Impact on Flowmon features

Collector functionality

The Flowmon Collector works without limitations using either sampling method. Common use cases remain fully functional:

• Traffic volume reporting
• Traffic structure analysis
• Volume increase alerts

ADS functionality

• Packet-level sampling limits some ADS features due to altered traffic characteristics
• Flow-level sampling supports all features because it preserves traffic patterns
• Large-scale anomalies and attacks remain detectable in backbone networks, making it suitable for:
  • Telecommunications companies
  • Internet Service Providers
  • Backbone network operators