I have the need to calculate the variance of the size of the packets in a flow. So it is impossible using IPFIX? There are new alternatives to IPFIX that would allow me to calculate that value? Thanks

  • Between your two questions, it seems you want to drive a nail with a screwdriver. IPFIX is the wrong tool for the job. I can't even really understand why you would want to know the variance in packet sizes in a flow; it just doesn't seem like useful information.
    – Ron Maupin
    Feb 7, 2017 at 14:29
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide your own answer and accept it.
    – Ron Maupin
    Aug 6, 2017 at 20:45

4 Answers 4


IPFIX's purpose is to measure packet flow, not the size of the single packet.

However, you can calculate the variance of packet size by time calculating the average size of a packet as the total flow volume divided by the number of packets during different intervals, and seeing how this value changes over time.

If you want to calculate the variance in size of different individual packets in a single flow, that's not possible AFAIK.

  • It can be a solution to add an entity to the IPFIX protocol? Feb 7, 2017 at 13:25

RMON can show the number of frames by size class, e.g. for HP Provision switches show rmon statistics <portno>:

Status and Counters - Port Counters for port 24

  Drop events     : 0                 Jabbers             : 0
  Octets          : 227,397,427       Collisions          : 0
  Packets         : 3,714,994,853     64 oct pkts         : 210,643,368
  Broadcast pkts  : 24,326,013        65-127 oct pkts     : 1,722,528,356

  Multicast pkts  : 83,481,276        128-255 oct pkts    : 719,535,071
  CRC errors      : 0                 256-511 oct pkts    : 243,979,239
  Runts           : 0                 512-1023 oct pkts   : 172,346,388
  Giants          : 0                 1024-1518 oct pkts  : 2,666,523,301
  Fragments       : 0

Understanding the characteristics of your data can be critical. If you can't get what you need with IPFIX, and it's somewhere you can get pcap files from, tcpdump-type tools plus awk-type tools will give you an answer pretty easily.

Use tcpdump or similar to get the packets you're interested in:

13:49:41.046756 IP > UDP, length 986
13:49:46.047115 ARP, Request who-has tell, length 46
13:49:46.047165 ARP, Reply is-at 30:65:ec:7f:3f:93, length 28
13:49:51.055195 IP > UDP, length 986
13:50:06.048098 IP > UDP, length 986

Then pipe through awk to get your statistics:

| awk '{++n; l=$NF; x+=l; xx+=l*l;}\
END{m=x/n; printf("n=%d m=%.2f sd=%.2f\n", n, m, sqrt((xx/n)-(m*m)))}'
n=5 m=606.40 sd=464.95

If you care about the statistical niceties (stability, pop vs sample etc) use R or python instead. Certainly R will give you nice graphs to understand the distribution of whatever categorisations you're interested in.


It is not possible to directly export the variance of the packet sizes in a IPFIX flow record. There is a now expired draft RFC that proposed additional IPFIX fields that would have provided statistical variance information (ipTotalLengthSampleMean, ipTotalLengthSampleVariance), but this was never approved, and the additional fields are not listed in the IANA IPFIX registry.

However using some of the standard IANA fields (octetDeltaCount, packetDeltaCount, octetDeltaSumOfSquares) that a device might include in an exported flow record it is possible to determine the variance and standard deviation.

Variance = (octetDeltaSumOfSquares/packetDeltaCount) - (octetDeltaCount/packetDeltaCount)²

The "Packet Sampling for Flow Accounting: Challenges and Limitations" paper by Tanja Zseby, Thomas Hirsch, Benoit Claise, is a good reference on the foundational theory of this statistical calculation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.