There are a few vendors who now provide traffic export from high-speed interfaces by sampling those interfaces at a particular rate, and using the sampled packets to populate the per-flow counters, rather than looking at every packet.

Folks might be interested in the Internet Draft on "A framework for passive packet measurement" that focuses on packet sampling. See http://www.ietf.org/internet-drafts/draft-duffield-framework-papame-00.txt There's a public mailing list at listname : psamp@ops.ietf.org subscribe: psamp-request@ops.ietf.org (with "subscribe" as the message) archive : https://ops.ietf.org/lists/psamp/ The goal is to define a minimal set of requirements that need to be supported in routers (or line cards) to meet the needs of folks that operate networks. Feedback more than welcome! -- Jen