Smoking Out the Heavy-Hitter Flows with HashPipe.

Identifying the flows or flows with large traffic volumes in the dataplane is important for several applications e.g., flow-size aware routing, DoS detection and traffic engineering. However, measurement in the data plane is constrained by the need for line-rate processing (at 10-100Gb/s) and limited memory in switching hardware. We propose HashPipe, a heavy hitter detection algorithm using emerging programmable data planes. HashPipe implements a pipeline of hash tables which retain counters for heavy flows in various stages while evicting lighter flows over time. We prototype HashPipe in P4 and evaluate it with CAIDA packet traces from an ISP backbone link. We find that HashPipe identifies 95% of the 300 heaviest flows with less than 80KB of memory on a trace that contains 500,000 flows.