Elephant Flow Detection for Flow Table Reduction under Realistic Traffic Distributions

The majority of Internet traffic is caused by a relatively small number of flows (so-called elephant flows). This phenomenon can be exploited to facilitate traffic engineering: resource-costly individual flow forwarding entries can be created only for elephants, while serving mice over shortest paths. Although this idea already appeared as a part of proposed TE systems, it was not examined by itself. It remains unknown what extent of flow table occupancy and operations number reduction can be achieved, how to select thresholds or sampling rates to cover the desired fraction of traffic or how to detect elephants with low computational and memory overhead. In this paper, we use reproducible traffic models obtained from 30-day-long campus/residential trace covering 4 billion flows to answer these questions. The most important finding is that simple packet sampling performs surprisingly well on realistic traffic, reducing the number of flow entries by a factor up to 400 with the aim to cover 80% of the traffic. Its superb performance and negligible overhead questions the need for more sophisticated algorithms. We also provide an open-source software package allowing the replication of our experiments or the performing of similar evaluations for other algorithms or flow distributions.