The random packet sampling is the most common sampling method in network management and measurement. Previous work focuses on estimating the flow size distribution for the complete population of flows from the random packet sampling data. However, there are a number of network applications which focus on the flow size distribution of a particular subpopulation. In this paper, we divide the complete pupulation of flows into two subsets：a subpopulation S  and its complementary set . We propose an algorithm for estimating the flow size joint distribution of Sand  using the TCP protocol imformation from the random sampling data. Experiments are conducted with the real network traces. The results show that the proposed method restores the original characteristics of the flow size distribution of subpopulations under the complete population of flows. Our algorithm also impoves the accuracy of flow size distribution estimation of subpopulations by using the TCP protocol imformation.