Detecting super-connection hosts is an important issue in network security and flow sampling is the key to solve this problem in high speed networks.The existing solutions use hash-based flow sampling algorithm

which assumes that the uniform random hash functions are available.However

this assumption can not be justified.By technical analysis and experiment tests

this paper concludes that the assumption is not true for linear flow IDs in high speed networks (above 2.5Gbps).A new flow sampling algorithm is presented subsequently

which exploits the Bloom Filter data structure.An analysis demonstrates that the new algorithm can support the 10Gbps line-speed processing with low space complexity.Experiments are also conducted based on real network traces.Results show that the proposed algorithm can achieve equal probability flow sampling independent of flow ID distribution.