I think it depends on how big you think each thing you want to identify is. If a heavy hitter contains 10% or 50% of traffic, then sampling is absolutely a grea

I think it depends on how big you think each thing you want to identify is. If a heavy hitter contains 10% or 50% of traffic, then sampling is absolutely a great approach. Since we're talking about DNS traffic here (very small packets), a "significant" increase in queries for one domain could be e.g. 0.01% or less, which could be much easier to miss with sampling.