ElephantTrap: A low cost device for identifying large flows

Abstract

This paper describes the design of ElephantTrap, a device which aims to cache the largest flows (the "elephants") on a network link. ElephantTrap differs from previous work on identifying large flows in one crucial sense: it does not attempt to accurately estimate the size of the flows it is trapping. This leads to an extremely lightweight design and a surprisingly good performance. ElephantTrap can be employed in the line cards of switches and routers and be used for diagnostics, anomaly detection and traffic engineering.