### Abstract

Identifying elephant flows is very important in developing effective and efficient traffic engineering schemes. In addition, obtaining the statistics of these flows is also very useful for network operation and management. On the other hand, with the rapid growth of link speed in recent years, packet sampling has become a very attractive and scalable means to measure flow statistics; however, it also makes identifying elephant flows become much more difficult. Based on Bayes' theorem, this paper develops techniques and schemes to identify elephant flows in periodically sampled packets. We show that our basic framework is very flexible in making appropriate trade-offs between false positives (misidentified flows) and false negatives (missed elephant flows) with regard to a given sampling frequency. We further validate and evaluate our approach by using some publicly available traces. Our schemes are generic and require no per-packet processing; hence, they allow a very cost-effective implementation for being deployed in large-scale high-speed networks.

Original language | English |
---|---|

Title of host publication | Proceedings of the 2004 ACM SIGCOMM Internet Measurement Conference, IMC 2004 |

Pages | 115-120 |

Number of pages | 6 |

Publication status | Published - 2004 Dec 1 |

Event | Proceedings of the 2004 ACM SIGCOMM Internet Measurement Conference, IMC 2004 - Taormina, Italy Duration: 2004 Oct 25 → 2004 Oct 27 |

### Publication series

Name | Proceedings of the 2004 ACM SIGCOMM Internet Measurement Conference, IMC 2004 |
---|

### Conference

Conference | Proceedings of the 2004 ACM SIGCOMM Internet Measurement Conference, IMC 2004 |
---|---|

Country | Italy |

City | Taormina |

Period | 04/10/25 → 04/10/27 |

### Keywords

- Bayes' theorem
- Flow statistics
- Measurement
- Packet sampling
- The elephant and mice phenomenon

### ASJC Scopus subject areas

- Engineering(all)

## Fingerprint Dive into the research topics of 'Identifying elephant flows through periodically sampled packets'. Together they form a unique fingerprint.

## Cite this

*Proceedings of the 2004 ACM SIGCOMM Internet Measurement Conference, IMC 2004*(pp. 115-120). (Proceedings of the 2004 ACM SIGCOMM Internet Measurement Conference, IMC 2004).