In order to understand the overall behavior of data traffic in a network domain, it is important to understand the characteristics of the individual data traffic flows in the network. The characteristics of the individual data traffic flows can include information about the individual data packets or metrics related to the set of packets in each data flow. These metrics can include measurements such as average data packet size, types of encapsulation of data packets, delay between sending and receiving data packets across the network domain, variations in throughput for data flows across the network (i.e., jitter), bandwidth utilization for a data flow, identification of a path for each data flow and similar metrics and data related to the each data flow. Once this sort of network analytic data has been collected for a data flow it can be analyzed in conjunction with similar data collected for the other data flows traversing the network to build an image or model of the behavior of data traffic across the network as a whole.
Collecting network analytic data is performed at a subset of nodes within the network domain. These nodes can be selected or placed within the network to provide a coherent picture of the data traffic in the network domain. For example, the nodes that collect the network analytic data can be ingress or egress nodes in the network domain at the edge of network domain enabling end to analysis of data flows. Nodes in the interior can also be utilized to identify internal bottlenecks and similar issues within the network domain. However, collecting and reporting network analytic data can consume significant resources at the node that is performing the collection.
The addition of this task to a node can have a negative effect on its performance. Thus, it is important that the collection of network analytic data at each participating node be as efficient as possible. Many solutions for collecting network analytic data are inefficient and unworkable. A naïve implementation would be to examine each data packet that traverses a node in the network. However, this would be to computationally intensive and would severely impact the performance of the node. In many cases, sampling is performed at a node to select a representative subset of the data traffic of the data flow to utilize for network analytics. However, the use of sampling prevents the tracking of the same data packet across the network domain. This limits the types of analysis that can be performed, because the information about data packets will vary from node to node and analysis based on end to end tracking of individual data packets cannot be performed.