# Estimating the Memory Consumption of a Hardware IP Defragmentation Block
## 4 Results
### Simulation Parameters  
The simulation was configured as follows:  
* The total number of traces is \(K=316\) with each trace lasting 15 min
* 130 packet traces from MAWI;
* 93 traces from WAND with 30 min length were split into two halves, giving 186 traces, each lasting 15 min.
* The total number of individual tests was chosen as \(M=\left\lceil K^{1.1}\right\rceil=562\).
* Each individual test was a mix of \(N=\left\lceil R*M\right\rceil\)_traces_, where \(R\) is a test composition ratio \(R\in\left\{0.1,0.25,0.5,0.75,0.9\right\}\)
* For each test run, the simulation program tested the following flow table parameters (see Figure 4):
* The number of flow table entries is \(A\times B=N_{f}\in\left\{16,32,64,128,256,512\right\}\);
* The associativity (number of ways) \(A\in\left\{1,2,4,8,16\right\}\).  
The test composition ratio \(R\) deserves a longer explanation, as it controls the outcome of the simulation. Since the number of tests \(M\) is constant throughout the experiment, the ratio \(R\) determines the number \(N\) of packet traces being sampled (Algorithm 1) and mixed (Algorithm 3). As the ratio \(R\) increases up to 1.0, the number of tests increase up to \(M\). The number of sampled and mixed tests have two consequences on the statistics obtained from the simulation:  
* The bandwidth of a synthetic packet trace (mixed by Algorithm 3) increases with the ratio \(R\). This is important in the case of IP fragmentation, as the original packet traces contain less than 1% of the relevant traffic.  
Figure 9: (**a**) Linear fit \(f(n)=an\) of \(\widehat{W}(n)\)—a number of fragment flows as a function of packet window size. Shaded areas represent the two widest confidence regions of the slope. (**b**) The Gaussian kernel density estimation of the distribution of the slope \(a\) for each series.  
* The statistical diversity (variance of the estimators) obtained from samples diminish as the \(R\) grows. This is observed empirically in Section 4.3 and can be deduced from the standard formula of a variance of a sample mean: \[Var(\widehat{X})=\frac{\sigma^{2}}{n}\] (9)  
As a result, the choice of the constant \(M\) should be a function of the desired traffic bandwidth and variance of the results. Note that \(M\) is not dependent on the number of original samples \(K\). Therefore, the choice of M can be arbitrary. This is a major advantage of such a sampling method over the traditional approach. It is somewhat analogous to the application of the bootstrap, which improves the robustness of any statistical estimator based on limited data on hand.  
```
0:\(S,M,N\)
1:for\(i:=1\) to \(M\)do
2:\(S^{\prime}:=S\)
3:\(S_{sample}:=\emptyset\)
4:for\(j:=1\) to \(N\)do
5:\(T_{j}:=\) a packet trace sampled without return from \(S^{\prime}\)
6:\(T_{j}^{\prime}:=Anonymize(T_{j},j)\)\(\triangleright\) Algorithm 2
7:\(S_{sample}:=S_{sample}\cup\{T_{j}^{\prime}\}\)\(\triangleright\) Add the trace to the sample
8:endfor
9:\(V_{i}:=Mix(S_{sample})\)\(\triangleright\) Algorithm 3
10:endfor
11:return\(\{V_{1},\dots,V_{M}\}\)\(\triangleright\) a final validation set
```  
**Algorithm 1** Test generation.  
```
0:\(S,M,N\)
1:for\(i:=1\) to \(M\)do
2:\(S^{\prime}:=S\)
3:\(S_{sample}:=\emptyset\)
4:for\(j:=1\) to \(N\)do
5:\(T_{j}:=\) a packet trace sampled without return from \(S^{\prime}\)
6:\(T_{j}^{\prime}:=Anonymize(T_{j},j)\)\(\triangleright\) Algorithm 2
7:\(S_{sample}:=S_{sample}\cup\{T_{j}^{\prime}\}\)\(\triangleright\) Add the trace to the sample
8:endfor
9:\(V_{i}:=Mix(S_{sample})\)\(\triangleright\) Algorithm 3
10:endfor
11:return\(\{V_{1},\dots,V_{M}\}\)\(\triangleright\) a final validation set
```  
**Algorithm 2** Trace anonymization