2017 年 5 月 Chinese Journal of Network and Information Security May 2017
00167-1
第 3 卷第 5 期 网络与信息安全学报 Vo l . 3
No.5
TPEFD: an SDN-based efficient elephant flow detection method
TIAN Yu
1
, LIU Jing
1,2,3
, LAI Ying-xu
1,2,3
, BAO Zhen-shan
1
, ZHANG Wen-bo
1
(1. Faculty of Information Technology, Beijing University of Technology, Beijing 100124, China;
2. Key Laboratory of Trusted Computing, Beijing 100124, China;
3. Information Security Rank Protection Key Technology National Engineering Laboratory, Beijing 100124, China)
Abstract: Software-defined networking (SDN) is a new approach to configure and operate programmable switches
of the networks (especially the data center networks) through a centralized software controller. Elephant flows nor-
mally exist in data center networks and take up a large amount of network bandwidth, so the elephant flow detection
is very important to ease network congestion. A two-phase real-time detection (TPEFD) method was proposed to
detect the elephant flows in the SDN-based network. First, the controller obtained aggregated statistics and shrank
sample scope until it was small enough, packets were sampled in the scope in switches. In order to identify the ele-
phant flows, the sFlow sampling results were compared with the dynamic threshold. If the sampling value exceeded
the threshold value, the flow was recognized as an elephant flow. The efficiency of our method in an SDN experi-
mental environment was evaluated. The experimental results indicated that the proposed method was feasible and
the detection time was efficient.
Key words: OpenFlow, elephant flows, flow detection, data center
doi: 10.11959/j.issn.2096-109x.2017.00167
1 Introduction
SDN technology based on OpenFlow
[1]
proto-
col, an open standard designed for SDN can sepa-
rate the control plane and data plane. We can use
SDN for traffic engineering and QoS management.
SDN enables network programmability and pro-
vides a new solution for the development and man-
agement of the network.
The network traffic is generally quantified by
flows which collect packets with the same features.
Network flows are generally identified by five
tuples in the packet header. The five tuples contain
source IP, destination IP, source port number, desti-
nation port number and IP protocol. The flow col-
lection is usually defined as an aggregation flow.
Elephant flows carry most of the network traffic in a
period of time, so it may have a long delay com-
pared with a small flow. In data center networks
[2~4]
,
although elephant flows only account for 2% of the
number of flows, it holds 90% of the network traffic.
Data center traffic has the characteristics of
heavy-tailed distribution
[5,6]
, the number of mice
flows is large while only account for little traffic.
This phenomenon is very important to improve the
network performance. The competition of resources
between elephant flows and mice flows will make it
very difficult for mice flows to obtain sufficient
bandwidth. It is not necessary for controller to oper-
ate all flows. The controller only needs to pay atten-
tion to the elephant flows that impact network per-
formance when network traffic managing, thus ele-
phant flow detection is very important to ease net-
work congestion.
ESHSP
[7]
classifies flow table entry according
to two dimensions {source IP, destination IP}, the
Received date: 2017-01-23, Revised date: 2017-02-15. Corresponding author: TIAN Yu, tianyu91@emails.bjut.edu.cn
Foundation Items: The Natural Science Foundation of Beijing (No.4162006), The Natural Science Foundation of Qinghai
Province (No.2017-ZJ-912)