Detecting heavy flows in the SDN match and action model

Yehuda Afek, Anat Bremler-Barr, Shir Landau Feibish, Liron Schiff

Research output: Contribution to journalArticlepeer-review


Efficient algorithms and techniques to detect and identify large flows in a high throughput traffic stream in the SDN match-and-action model are presented. This is in contrast to previous work that either deviated from the match and action model by requiring additional switch level capabilities or did not exploit the SDN data plane. Our construction has two parts; (a) new methods to efficiently sample in an SDN match and action model, (b) new and efficient algorithms to detect large flows efficiently and in a scalable way, in the SDN model. Our large flow detection methods provide high accuracy and present a good and practical tradeoff between switch - controller traffic, and the number of entries required in the switch flow table. Based on different parameters, we differentiate between heavy flows, elephant flows and bulky flows and present efficient algorithms to detect flows of the different types. Additionally, as part of our heavy flow detection scheme, we present sampling methods to sample packets with arbitrary probability p per packet or per byte that traverses an SDN switch. Finally, we show how our algorithms can be adapted to a distributed monitoring SDN setting with multiple switches, and easily scale with the number of monitoring switches.

Original languageEnglish
Pages (from-to)1-12
Number of pages12
JournalComputer Networks
StatePublished - 8 May 2018

Bibliographical note

Funding Information:
This research was supported by European Research Council (ERC) Starting Grant no. 259085, and the Neptune Consortium, administered by the Office of the Chief Scientist of the Israeli ministry of Industry, Trade, and Labor, and the Ministry of Science and Technology, Israel.

Publisher Copyright:
© 2018 Elsevier B.V.


  • Heavy Hitters
  • Network measurement
  • Packet sampling
  • SDN


Dive into the research topics of 'Detecting heavy flows in the SDN match and action model'. Together they form a unique fingerprint.

Cite this