Online heavy hitter detector on FPGA

Abstract

Abstract-Detecting heavy hitters is essential for many network management and security applications in the Internet and in data centers. Heavy hitter is the entity in a data stream whose amount of activity, such as bandwidth consumption or number of connections is higher than a given threshold. In this work, we propose a pipelined architecture for an online heavy hitter detector on FPGA. It also reports the top K heavy hitters. We design an application specific data forwarding mechanism to handle data hazards without stalling the pipeline. The stream size and the threshold for heavy hitter detection can be configured through run-time parameters. The post place-and-route results on a state-of-the-art FPGA shows that the architecture can achieve a throughput of 84 Gbps supporting 128 K concurrent flows. The proposed architecture can support large number of concurrent flows using external memory while sustaining the same throughput as the on-chip BRAM based implementation.

A Flexible Sketch-Based Network Traffic Monitoring Infrastructure

“…The operations are executed in a three-stage pipeline: in the memory read stage, the counter value at the address given by the 5-universal hash result is retrieved from the table; in the second stage, the counter value returned from memory is modified; and, finally, in the memory write stage the updated counter value is written back to the memory. To avoid read after write (RAW) hazards that can occur during the counter update process, a circuit to handle RAW hazards adopted from [46] can be used. A RAW hazard occurs if an input ID enters the pipeline before the previous update of the same input ID has been completed.…”

“…At the end of each observation interval, the heavy hitter detection algorithm reports the IDs and sizes of all flow whose sizes exceeded a predefined threshold. A heavy hitter can be mathematically defined as follows [46]: Given an input packet stream σ =…”