Sample and Fetch-Based Large Flow Detection Mechanism in Software Defined Networks

Detecting large flows in a software-defined network accurately is important for many applications. However, due to the constraints of measurement resources such as TCAMs, the existing solutions often suffer from feasibility and accuracy issues. In this letter, by combining the advantages of sampling and flow counting, we propose FlowMon, a sample and fetch-based two-stage large flow detection mechanism. FlowMon first captures the suspicious large flows through coarse-grained sampling method, and then notifies the SDN controller to determine the true large flows from these suspicious ones by installing measurement rules in the specific OpenFlow switches. To optimize the TCAM resource allocation, we also design a dynamic flow entry assignment model. Experiment results show that FlowMon can improve the large flow detection accuracy, decrease the TCAM resource consumption, and balance the measurement load among OpenFlow switches.