I find sticky sampling and lossy counting to be useful for this kind of thing. In fact it's what I use to identify heavy hitters of my high traffic DNS servers.

I find sticky sampling and lossy counting to be useful for this kind of thing. In fact it's what I use to identify heavy hitters of my high traffic DNS servers. http://www.vldb.org/conf/2002/S10P03.pdf http://www.vldb.org/conf/2002/S10P03.pdf