No abstract

We present an algorithm, Shared-State Sampling (S 3 ), for the problem of detecting large flows in high-speed networks. While devised with different principles in mind, S 3 turns out to be a generalization of two existing algorithms tackling the same problem: Sample-and-Hold and Multistage Filters. S 3 is found to outperform its predecessors, with the advantage of smoothly adapting to the memory technology available, to the extent of allowing a partial implementation in DRAM. S 3 exhibits mild tradeoffs between the different metrics of interest, which greatly benefits the scalability of the approach. The problem of detecting frequent items in streams appears in other areas. We also compare our algorithm with proposals appearing in the context of databases and regarded superior to the aforementioned. Our analysis and experimental results show that, among those evaluated, S 3 is the most attractive and scalable solution to the problem in the context of high-speed network measurements.

No abstract

No abstract

We present two algorithms to the problem of identifying and measuring heavy-hitters. Our schemes report, with high probability, those flows that exceed a prescribed share of the traffic observed so far; along with an estimate of their sizes. One of the biggest advantages of our schemes is that they entirely rely on sampling. This makes them flexible and lightweight, permits implementing them in cheap DRAM and scale to very high speeds. Despite sampling, our algorithms can provide very accurate results and offer performance guarantees independent of the traffic mix. Most remarkably, the schemes are shown to require memory that is constant regardless of the volume and composition of the traffic observed. Thus, besides computationally light, costeffective and flexible, they are scalable and robust against malicious traffic patterns. We provide theoretical and empirical results on their performance; the latter, with software implementations and real traffic traces.