How Bloom filters work

Hello,
A CMS (Count Min Sketch) can give an approximation of the number an element appears in a flow. For example, the count of a specific IP from which requests arrive.
The result given by a CMS is relevant only if it is higher than the noise in the sketch. For example, if a CMS has 100 buckets and 1000 elements in it, any result up to 10 is just noise since on average, each bucket will get 10 hits. If a bucket has 50 results, we can assume a heavy-hitter or an elephant is counted into it. Therefore, in this case, if the return count is 10, you should ignore it, if it is 50, you can use it and assume the rel count is slightly lower.
Note: The sketch uses multiple arrays/sketches in order to reduce the probability of collision between elephants and mice.
Cheers