Heavy Hitter Flow Detection using P4-based Programmable Data Plane Switches

In data networks carrying large numbers of flows, Heavy Hitters (HHs) or Elephant flows are the flows exceeding pre-determined thresholds (e.g. wrt. number of packets or bytes) in a given time window. Such HH flows need to be handled differently in order to minimize their impact on other smaller flows. In recent years, HH detection techniques were shown to be effectively implementable in programmable data plane switches. In recent work, it was shown that the inter-packet gap can be used to identify heavy hitters. In order to conserve memory, such schemes use a limited-size hash table for storing flow state information and using this for the detection. However, when hash collisions occur, it is possible that a valid HH flow in the table can be replaced by a non-HH flow resulting in missing detection of HH flows. To address this problem, this paper incorporates a flow’s medium term Packet Count feature. In order to limit the packet count field size in the hash table, counting is done only till Hash Collision occurs so as to the reduce the range of values to be stored and thus, the required number of bits. The proposed scheme has been implemented in the P4 language and run on Intel Tofino hardware. Performance evaluation has been done using MAWI-based real-life traffic traces. The results shows that in several scenarios cases, we can significantly reduce the False Negatives for HHs by using the packet count data effectively and efficiently.