Automatic dynamic determination of data traffic sampling policy in a network visibility appliance

A network appliance comprising:

• a first network port through which to receive a first plurality of flows originated by a plurality of sources on a network during a first time period, each said flow including a series of packets between a source and a destination within a same transport connection;
• a first instrument port through which to forward at least some of the first plurality of flows to a tool;
• a second instrument port through which to receive the at least some of the first plurality of flows from the tool after the tool has processed the flows;
• a second network port through which to forward the first plurality of flows onto the network for delivery to a destination;
• and
• a processor configured to cause the network appliance to perform operations including
• ascertaining an expected value of a characteristic of data traffic associated with the network for a second time period that is after the first time period, by examining packets of the first plurality of flows;
• dynamically determining a sampling policy for forwarding flows from the network appliance to the tool, based on the ascertained expected value of the characteristic of the data traffic, without user input specifying the sampling policy;
• receiving, by the network appliance, a second plurality of flows communicated on the network during the second time period;
• and
• using the determined sampling policy to select some but not all of the second plurality of flows to be forwarded by the network appliance to the tool.

A non-transitory machine-readable storage medium tangibly storing code, execution of which by at least one processor in a network appliance causes the network appliance to perform operations comprising:

• receiving a first plurality of flows communicated on a network during a first time period, each said flow including a series of packets between a source and a destination within a same transport connection, the network appliance being configured to forward flows selectively to a tool that is external to the network appliance;
• ascertaining an expected value of a characteristic of data traffic associated with the network for a second time period that is after the first time period, by examining packets of the first plurality of flows;
• dynamically determining a sampling policy for forwarding flows from the network appliance to the tool, based on the ascertained expected value of the characteristic of the data traffic, without user input specifying the sampling policy;
• receiving, by the network appliance, a second plurality of flows communicated on the network during the second time period;
• accessing the determined sampling policy, by the network appliance;
• and
• using the determined sampling policy, by the network appliance, to select flows of the second plurality of flows to be forward to the tool.