随机分组抽样是网络管理和测量中最常见的抽样方法。已有的研究大都集中在此抽样方法下基于总体的流大小分布估计算法，但一些网络应用更关心总体流量中某个子群体的流大小分布。本文将总体的网络流划分成子群体S和子群体的补集，提出了一种在随机分组抽样下运用TCP协议信息的由S与共同组成流大小的联合分布的估计算法。实验证明，该算法能够较好地还原子群体及其在总体下的流大小分布的特征；另一方面，通过运用样本流中TCP协议信息，提高了子群体流大小分布估计算法的准确性。

The random packet sampling is the most common sampling method in network management and measurement. Previous work focuses on estimating the flow size distribution for the complete population of flows from the random packet sampling data. However, there are a number of network applications which focus on the flow size distribution of a particular subpopulation. In this paper, we divide the complete pupulation of flows into two subsets：a subpopulation S  and its complementary set . We propose an algorithm for estimating the flow size joint distribution of Sand  using the TCP protocol imformation from the random sampling data. Experiments are conducted with the real network traces. The results show that the proposed method restores the original characteristics of the flow size distribution of subpopulations under the complete population of flows. Our algorithm also impoves the accuracy of flow size distribution estimation of subpopulations by using the TCP protocol imformation.