Abstract:Collecting flow records is a common practice of network operators and researchers for monitoring, diagnosing and understanding a network. Traditional tools like NetFlow face great challenges when both the speed and the complexity of the network traffic increase. To keep pace up, we propose HashFlow, a tool for more efficient and accurate collection and analysis of flow records. The central idea of HashFlow is to maintain accurate records for elephant flows, but summarized records for mice flows, by applying a novel collision resolution and record promotion strategy to hash tables. The performance bound can be analyzed with a probabilistic model, and with this strategy, HashFlow achieves a better utilization of space, and also more accurate flow records, without bringing extra complexity. We have implemented HashFlow, as well as several latest flow measurement algorithms such as FlowRadar, HashPipe and ElasticSketch, in a P4 software switch. Then we use traces from different operational networks to evaluate them. In these experiments, for various types of traffic analysis applications, HashFlow consistently demonstrates a clearly better performance against its state-of-the-art competitors. For example, using a small memory of 1 MB, HashFlow can accurately record around 55K flows, which is often 12.5% higher than the others. For estimating the sizes of 50K flows, HashFlow achieves a relative error of around 11.6%, while the estimation error of the best competitor is 42.9% higher. It detects 96.1% of the heavy hitters out of 250K flows with a size estimation error of 5.6%, which is 11.3% and 73.7% better than the best competitor respectively. At last, we show these merits of HashFlow come with almost no degradation of throughput.

Fast Flow Volume Estimation

An Efficient Adaptive Denoising Sketch for Per-flow Traffic Measurement

HashFlow For Better Flow Record Collection

Efficient and Accurate Flow Record Collection With HashFlow

Unbiased Real-time Traffic Sketching

An Adaptive Strategy for High-Speed Network Flow Compression

FlowMon-DPDK: Parsimonious Per-Flow Software Monitoring at Line Rate

Randomized Admission Policy for Efficient Top-k and Frequency Estimation

Hierarchical Sketch: an Efficient Solution for Threshold-t Flows Measurement in High-Speed Networks

Continuous Flow Measurement with SuperFlow.

Pay for a Sliding Bloom Filter and Get Counting, Distinct Elements, and Entropy for Free

A novel spread estimation based abnormal flow detection in high-speed networks

Estimation of Flow Size Distribution During Random Packet Sampling

End-to-End Traffic Flow Rate Estimation From Compressed Video Streams

FastKeeper: A Fast Algorithm for Identifying Top-k Real-time Large Flows

An effective and accurate flow size measurement using funnel-shaped sketch

StreamFlow: Streamlined Multi-Frame Optical Flow Estimation for Video Sequences

Hypersparse Network Flow Analysis of Packets with GraphBLAS

Agc Sketch: an Effective and Accurate Per-Flow Measurement to Adapt Flow Size Distribution

ANLS: Adaptive Non-Linear Sampling Method for Accurate Flow Size Measurement.

ServeFlow: A Fast-Slow Model Architecture for Network Traffic Analysis