On the Practical Detection of Heavy Hitter Flows

The detection of of Heavy Hitter (HH) flows in a network device is a critical building block in many control and management tasks. A flow is considered a Heavy Hitter flow if its portion from the total traffic surpasses a given threshold. One of the most important aspect of this detection is its practicality; i.e., being able to work in line rate using the available scarce local memory in the device. In this paper, we present a practical heavy hitters detection algorithm that requires a constant amount of memory (not related to the number of flows or the number of packets) and performs at most O(1) operation per packet to keep with line rate. We present an analysis of errors for our algorithm and compare it to state-of-the-art monitoring solutions, showing a superior performance where the allocated memory is less than 1MB. In particular, we are able to detect more HH flows with less false positive without increasing the per-packet processing time.