Your border exports 1-in-1000 sampled NetFlow — why might a short DNS-tunnel session leave no record?

## What sampling actually does On a multi-site campus with high-rate uplinks, exporting a record for every flow is often infeasible, so exporters are configured to sample. In *packet* sampling — the common case, and what sFlow does by design — the device selects one packet in every N (deterministically or randomly) and only those selected packets feed the flow cache. NetFlow and IPFIX can be configured this way; the sampling rate is normally advertised in the export so the collector can scale counters. The critical consequence is not that counts are approximate. It is that **flows appear or fail to appear probabilistically**. A flow reaches the collector only if at least one of its packets was among those sampled. ## The arithmetic, and why short sessions disappear For a flow of *k* packets at rate 1-in-*N*, the chance the flow is observed at all is roughly `1 - (1 - 1/N)^k`. - A 20-packet exchange at 1-in-1000: about 2 percent. - A 200-packet session: about 18 percent. - A 29,000-packet bulk transfer: effectively certain, and sampled many times over, so its scaled byte count is reasonably accurate. A DNS tunnel that carries a small amount of data in a burst of queries and responses is at the wrong end of this curve. Even if it crossed the exporter, the odds are strongly that nothing about it was exported — and there is no marker in the collector saying "a session was missed here". Sampling loss is silent. There is a second reason this particular session may be missing, and it is worth raising in an interview because it is about the topology rather than the sampler: if the campus uses a central recursive resolver, client machines talk to the resolver, and the border exporter only ever sees the *resolver* talking upstream. The client-to-resolver leg may never cross an exporter at all. ## What claims survive sampling, and what do not Sampled flow is a **volumetric** instrument, and a good one: - "About 40 GB left this site between 01:00 and 05:00" — trustworthy in order of magnitude, because aggregate estimates converge as the byte total grows. - "The top talkers on this uplink were these ten hosts" — usually right, since elephant flows are almost surely sampled. Sampled flow cannot support **existence** claims: - "This host never contacted that address" — unsupported. The correct sentence is "no matching record was exported", which is much weaker. - "This session transferred exactly 1.4 MB" — a small flow's counters are a scaled estimate that may be extrapolated from one packet, so the error can be enormous in relative terms. The generalisation to carry away: **the absence of a record in a sampled feed is not evidence of the absence of the traffic.** That is a different failure from a rule not firing or a source going dark, and the honest way to report it is to say which of the three you are looking at. ## Designing around it If existence questions matter — and in security operations they usually do — move them to a feed that records every event: - Unsampled flow or connection logging at a chokepoint (firewall session logs, a dedicated probe on a smaller aggregation link). - Resolver query logs, which record every name asked for regardless of packet rate. - Proxy records, which log every request and add the client and user. - Endpoint network telemetry, which ties an outbound connection to a process on the host that made it. A workable split is sampled flow on the high-rate border for capacity-scale volumetrics, unsampled records at the places where an intruder's traffic must pass and where the volume is affordable. What is not workable is keeping sampled flow and continuing to ask it questions it structurally cannot answer. ## Knowing your own rate Before any of this, know the configured rate on each exporter and whether it is uniform. Estates commonly run different rates per device, and analysts inherit a query that silently mixes a 1-in-1 access switch with a 1-in-1000 core router. When you present a byte figure from a sampled feed, say the rate; when you present an absence, say that the feed is sampled and what that does to the claim.