![Flow 101
Business
Understanding
Flow Source Destination
Flow 1 Host A Server
Flow 2 Server Host B
5-tuple flow
[Source IP, Source
port, Destination
IP, Destination
port, Protocol]
What are Heavy-Hitter flows?
Flows that contribute the maximum to
network traffic volume.
Why detect them?
Visibility: Identify cause for network
congestion
Provisioning: Route via high-
bandwidth paths
Capacity Planning: Fair bandwidth
allocation to all flows
Pricing: Accounting and Billing
Host B
Router
Server
Host A
What is a Flow?](https://image.slidesharecdn.com/ml-heavyhitterschangedetection-200119111418/85/Heavy-Hitters-Change-Detection-2-320.jpg)
Heavy Hitters Change Detection
- 1. Detecting changes in Heavy-Hitter flows @ the Network Edge Madhusoodhana Chari S ( Madhu ) Rangaprasad Sampath ( Ranga ) Misra, Parikshit ( Parkshit )
- 2. Flow 101 Business Understanding Flow Source Destination Flow 1 Host A Server Flow 2 Server Host B 5-tuple flow [Source IP, Source port, Destination IP, Destination port, Protocol] What are Heavy-Hitter flows? Flows that contribute the maximum to network traffic volume. Why detect them? Visibility: Identify cause for network congestion Provisioning: Route via high- bandwidth paths Capacity Planning: Fair bandwidth allocation to all flows Pricing: Accounting and Billing Host B Router Server Host A What is a Flow?
- 3. Count-Min Sketch Objective Returns the frequency of x in a dataset USP Storage and Compute efficient Operations Supported Insert(x) and Count(x) Constituents width - n columns of counters depth - k rows k hashes, one for each row Data Understanding Insert (x) k hashes increment counters in rows Repeat Insert (x) Count (x) = Min (values of counters in k rows) Images Credit: Probabilistic Data Structures
- 4. Change in Heavy-Hitter Flow List Data Preparation Modelling
- 5. Coming together @ the Edge Network Switch Evaluation
- 6. Value @ the Edge Deployment Event logging Anomaly detection Resource monitoring Flow lookup Why should Heavy-Hitters detection be @ the Edge? Localized, Fast Decisions No roundtrip to the Cloud Lower bandwidth Minimize WAN bandwidth consumption Granular policy adherence Mark, monitor, police heavy-hitter flows at every edge switch Capable hardware Modern CPUs, GPUs, TPUs can run Analytics
- 7. Reach out to Madhusoodhana Chari S https://www.linkedin.com/in/madhucharis/ madhucharis@gmail.com Rangaprasad Sampath https://www.linkedin.com/in/rangaprasad-sampath ranga.sampath@gmail.com Misra Parikshit https://www.linkedin.com/in/parikshit-misra-a2721a30/