ElephantTrap: A low cost device for identifying large flows

This paper describes the design of ElephantTrap, a device which aims to cache the largest flows (the "elephants") on a network link. ElephantTrap differs from previous work on identifying large flows in one crucial sense: it does not attempt to accurately estimate the size of the flows it is trapping. This leads to an extremely lightweight design and a surprisingly good performance. ElephantTrap can be employed in the line cards of switches and routers and be used for diagnostics, anomaly detection and traffic engineering.

[1]  Cristian Estan,et al.  New directions in traffic measurement and accounting , 2001, IMW '01.

[2]  Ratul Mahajan,et al.  Controlling high-bandwidth flows at the congested router , 2001, Proceedings Ninth International Conference on Network Protocols. ICNP 2001.

[3]  Devavrat Shah,et al.  Analysis of a statistics counter architecture , 2001, HOT 9 Interconnects. Symposium on High Performance Interconnects.

[4]  Azer Bestavros,et al.  Self-similarity in World Wide Web traffic: evidence and possible causes , 1996, SIGMETRICS '96.

[5]  George Varghese,et al.  Building a better NetFlow , 2004, SIGCOMM 2004.

[6]  George Varghese,et al.  Efficient implementation of a statistics counter architecture , 2003, SIGMETRICS '03.

[7]  Scott Shenker,et al.  Approximate fairness through differential dropping , 2003, CCRV.