Sequential Zeroing: Online Heavy-Hitter Detection on Programmable Hardware

Belma Turkovic, Jorik Oostenbrink, Fernando Kuipers, Isaac Keslassy, Ariel Orda

Research output: Chapter in Book/Conference proceedings/Edited volumeConference contributionScientificpeer-review

94 Downloads (Pure)


Flows that have exceeded a given percentage of the last sliding window of N packets, denoted as heavy-hitter flows, require special handling, since they may disrupt the service of other flows or may be indicative of malicious traffic. However, even when equipped with a programmable switch, it is unclear how to detect heavy hitters on a per-packet basis, while obeying the stringent switch memory access rates. For instance, existing solutions, such as HashPipe, cannot detect heavy hitters without halving the line rate and do not support sliding windows. To the best of our knowledge, this paper is the first to present heavy-hitter detection solutions that provide per-packet granularity at line-rate performance. We realize this by in- troducing (1) Modulo sketching, a novel counting algorithm that reuses counters and limits the impact of smaller flows beyond early processing stages; and (2) Sequential Zeroing, a new approach to extending interval-based schemes to sliding window measurements. Our solutions are extensively evaluated, both via simulations and experiments on a Netronome SmartNIC, and demonstrate significant performance gains over the state-of-the- art.
Original languageEnglish
Title of host publicationProceedings of IFIP Networking 2020
Number of pages9
ISBN (Electronic) 978-3-903176-28-7
Publication statusPublished - 2020
Event19th International IFIP TC6 Networking Conference, Networking 2020 - Paris, France
Duration: 22 Jun 202025 Jun 2020
Conference number: 19


Conference19th International IFIP TC6 Networking Conference, Networking 2020
Abbreviated titleNetworking 2020
OtherVirtual/online event due to COVID-19

Fingerprint Dive into the research topics of 'Sequential Zeroing: Online Heavy-Hitter Detection on Programmable Hardware'. Together they form a unique fingerprint.

Cite this