Revisiting heavy-hitters: don't count packets, compute flow inter-packet metrics in the data plane

Abstract

Detecting Heavy Hitter (HH) flows, i.e., flows exceeding a pre-determined threshold in a time window, is a fundamental task as it enables network management and security applications like DoS attack detection/prevention, flow-size aware routing, and QoS. The recent breakthroughs of programmable data planes has provided an unique opportunity: detect them directly in the data plane to enable fast control decisions. State-of-the-art solutions leverage either probabilistic data structures [1, 2] or prefix trees [3] to store flow counters directly in the programmable pipeline of switches. However, the former approach still depends on the intervention of a central controller to identify the HH flows from the hash-buckets, thus partially diminishing the fast data plane reaction. The latter approach instead, while successfully implemented on FPGA, is not yet a feasible solution for today's programmable ASICs due to limited accesses to registers [4].