NODE: Network Wide Top-K Flows in the Data Plane

2026-04-26

AI Summary

This work addresses the high response latency and poor adaptability to short-lived traffic bursts inherent in existing Top-K flow detection methods that rely on centralized controllers. To overcome these limitations, the authors propose a fully distributed cooperative algorithm that operates entirely within the programmable data plane, enabling all network switches to collaboratively aggregate information and consistently maintain a global Top-K flow table without any involvement from the control plane. This approach represents the first solution to achieve network-wide Top-K flow detection purely in the data plane, guaranteeing convergence to identical results across all switches. Experimental evaluations demonstrate over 95% recall under both real-world and synthetic traffic traces, with per-switch memory overhead below 300 KB.

Technology Category

• Search and Optimization: Distributed Search
• Planning, Routing, and Scheduling: Plan Execution and Monitoring
• Data Mining & Knowledge Management: Anomaly/Outlier Detection

Application Category

• Systems and Infrastructure for Web, Mobile and WoT: Data management and stream processing for Web, mobile and wireless applications
• Responsible Web: Human-perceived consequences of algorithmic deployment on the web
• Graph Algorithms and Modeling for the Web: Efficient manipulation of static and dynamic Web-related graphs

Abstract

Monitoring network traffic is crucial for most network tasks, such as, identifying and blocking attacks, pinpointing failures and engineering and rerouting heavy traffic to maintain high throughput. One important metric when monitoring the traffic is finding the top-k heavy flows, that is the k heaviest flows in the traffic. Programmable networks allow performing advanced network analysis right in the data plane. In recent years, various solutions have been proposed for efficiently finding the top-k heavy flows within a single switch. However, at times we may need to find the global top-k flows. Existing solutions for global top-k detection use a centralized controller that collects and aggregates the measurements performed in each of the switches. Yet, the process of sending information to the control plane and then having the controller send back the information to the switches can be very lengthy. In order to be able to detect and mitigate short-lived events, solutions that work completely within the data plane are needed. In this paper we present NODE, a network-wide top-k detection algorithm that operates exclusively in the data plane. NODE allows the switches to aggregate information from all other switches in the network, and ensures that eventually all switches hold an identical global top-k table. We show that NODE manages to detect global top-k flows on both synthetic and real traces, with a recall rate of over 95\% while using less than 300KB per switch.

Problem

• top-k flows
• data plane
• network-wide monitoring
• programmable networks
• heavy hitters

Innovation

• in-data-plane processing
• network-wide top-k detection
• programmable data plane
• distributed flow aggregation
• heavy-hitter detection