A single-FPGA architecture for detecting heavy hitters in 100 Gbit/s ethernet links

In network traffic monitoring, a very important analysis is to find heavy hitters. That is, finding those flows that use most resources in a given network link. This information can be very useful for security or traffic management purposes. Though this analysis might seem easy to implement, since it is essentially based on counting, the fact is that doing it at 100 Gbit/s rates is far from trivial. In 100 Gbit/s Ethernet (100 GbE), up to 148 million packets per second can be received, thus making it very difficult to parse packets and maintain counters at such rate. In this paper, we leverage the integrated 100G Ethernet Subsystem available in Xilinx UltraScale devices to implement a heavy hitter detector for 100 GbE in a VCU108 evaluation kit. Thanks to the integration of the Count Sketch algorithm with a priority list and a network packet parser, the proposed architecture is able to work at line rate for average packet sizes bigger than 215 bytes. The work presents a theoretical analysis of the error, as well as the technical details of the proposed solution. The implementation has been validated using real-world traces, obtaining an average error of 1.29%.