Application aware elephant flow identification
View Patent ↗A network device identifies elephant flows. The network device filters received network data according to an application-specific criteria and identifies the elephant flow from the filtered network data. To do so, the network device can employ a multi-stage filtering process to identify an elephant flow in the received network data. The network device separates the filtered network data into multiple macroflows using a first hash function, and identifies the macroflow with the highest rate. Then, the network device disaggregates the high rate macroflow into multiple microflows using a second hash function and identifies the highest rate microflow as the elephant flow. The network device maintains an elephant flow cache with entries for currently identified elephant flows. The network device may also take management actions on the elephant flows, and the management actions may be application specific.
1. A method comprising:
in a network device:
obtaining an application identification criterion for a specific application;
receiving network flow data in the network device;
applying the application identification criterion to the network flow data to identify application specific network flow data arising from the specific application; and
performing a jumbo flow analysis on the application specific network flow data to determine whether a jumbo network flow is present for that particular application, the jumbo flow analysis comprising:
identifying a specific macroflow in the application specific network flow data, the specific macroflow comprising multiple component dataflows;
disaggregating the specific macroflow into the multiple component dataflows; and
identifying, as the jumbo network flow, a specific dataflow among the multiple component dataflows that meets a jumbo network flow identification criterion.
2. The method of claim 1 , where identifying a specific macroflow comprises:
separating the application specific network flow data into multiple macroflows; and
determining, from among the macroflows, the specfic macroflow as a macroflow with highest data rate among the multiple macroflows.
3. The method of claim 2 , where separating comprises:
applying, to a packet in the application specific network flow data, a first hash function; and
determining a macroflow assignment for the packet according to output of the first hash function for the packet.
4. The method of claim 3 , further comprising:
incrementing a first packet count responsive to the macroflow assignment after the hash function is applied.
5. The method of claim 4 , where determining the specific macroflow comprises:
determining that the first packet count has exceeded a second packet count, the second packet count incremented responsive to a different macroflow assignment.
6. The method of claim 4 , further comprising:
decrementing the first packet count when a specified decrement criterion is met.
7. The method of claim 1 , where the application identification criterion comprises inclusion of an application specific marking within the network data flow.
8. A device comprising:
an elephant flow cache storing:
a first elephant flow;
elephant flow identification circuitry operable to:
obtain first network data;
extract packets belonging to the first elephant flow from the network data to obtain second network data not including the packets belonging to the first elephant flow;
filter the second network data according to a predetermined application specific criterion to obtain filtered network data;
determine a second elephant flow from the filtered network data;
add the second elephant flow to the elephant flow cache; and
determine a selected elephant flow by:
disaggregating the filtered network data into multiple macroflows according to a macroflow criterion;
identify a top macroflow from among the multiple macroflows;
disaggregate the top macroflow into multiple microflows according to a microflow criterion; and
identify a top microflow from among the multiple microflows as the selected elephant flow.
9. The device of claim 8 , where the elephant flow identification circuitry is operable to disaggregate the filtered network data by applying a macroflow hash function to the filtered network data.
10. The device of claim 9 , where the elephant flow identification circuitry is operable to disaggregate the top macroflow by applying a microflow hash function to the top macroflow.
11. The device of claim 10 , where the macroflow hash function is orthogonal to the microflow hash function.
12. The device of claim 8 , where the elephant flow identification circuitry is operable to disaggregate the top macroflow based on a predetermined packet fields.
13. The device of claim 12 , where the packet fields comprise a source address, a destination address, a source port, a destination port, protocol number of a first top macroflow packet, or any combination thereof.
14. The device of claim 8 , where the elephant flow identification circuitry is configured to filter the second network data according to a predetermined application specific criterion by filtering the second network data according to an application specific marking within the second network data.
15. A device comprising:
a memory comprising:
identification parameters;
a macroflow cache; and
a microflow cache; and
elephant flow identification circuitry in communication with the memory, the elephant flow identification circuitry operable to:
read the identification parameters to obtain an application specific criterion;
filter network data according to the application specific criterion to obtain filtered network data;
disaggregate the filtered network data into multiple macroflows and store the multiple macroflows in the macroflow cache;
identify a top macroflow from among the multiple macroflows;
disaggregate the top macroflow into multiple microflows and store the multiple microflows in the microflow cache; and
identify a top microflow from among the multiple microflows as a selected elephant flow.
16. The device of claim 15 , where the macroflow cache is implemented as a bubble-up cache, and where the elephant flow identification circuitry is operable to identify the top macroflow as a macroflow that is first in the macroflow cache.
17. The device of claim 15 , where the microflow cache is implemented as a bubble-up cache, and where the elephant flow identification circuitry is operable to identify the top microflow as a microflow that is first in the microflow cache.
18. The device of claim 15 , where the elephant flow identification circuitry is operable to disaggregate the filtered network data by applying a macroflow hash function to the filtered network data.
19. The device of claim 18 , where the elephant flow identification circuitry is operable to disaggregate the top macroflow by applying a microflow hash function to the top macroflow.
20. The device of claim 19 , where the macroflow hash function is orthogonal to the microflow hash function.