A heuristic method of finding heavy hitter prefix pairs in IP traffic

This paper describes a heuristic method of finding prefix pairs in IP traffic, which represent more than a prescribed threshold of global traffic. Two Patricia trees are used for finding those source and destination prefixes with a sufficient amount of traffic. A heuristic method is then proposed to identify those pairs of prefixes with a total amount of traffic exceeding a given proportion of global traffic. The proposed algorithm is tested against NetFlow data from Orange's transit IP network.