Elephant flow detection in a computing device

Abstract

Example embodiments relate to elephant flow detection in a computing device. In example embodiments, a computing device may monitor a socket for a given flow. The computing device may then determine whether the flow is an elephant flow based on the monitoring of the socket. If so, the computing device may signal the network that transmits the flow that the flow is an elephant flow.

1 . A source computing device for detection of elephant flows, the source computing device comprising:
 a processor to:   monitor outgoing data provided from an application to a socket provided by an operating system (OS) of the source computing device, the outgoing data associated with a particular flow originating in the application,   determine, at the source computing device, based on the monitoring of the outgoing data provided to the socket, whether the particular flow is an elephant flow, and   send a signal into a network that transmits the particular flow, the signal indicating that the particular flow is an elephant flow.   
     
     
         2 . The source computing device of  claim 1 , wherein, to monitor, determine, and send, the processor executes logic included in a shim layer of the OS of the computing device. 
     
     
         3 . The source computing device of  claim 1 , wherein:
 the processor monitors an amount of data provided to the socket during a given period of time,   the processor determines a rate at which the data was provided to the socket based on the amount of data and a duration of the given period of time, and   the processor determines that the particular flow is an elephant flow when the determined rate exceeds a given value.   
     
     
         4 . The source computing device of  claim 1 , wherein:
 the processor monitors a total amount of data provided to the socket since the socket was opened for the particular flow, and   the processor determines that the particular flow is an elephant flow when the total amount of data provided to the socket exceeds a given value.   
     
     
         5 . The source computing device of  claim 1 , wherein:
 the processor monitors a current fill level of a socket buffer corresponding to the socket, and   the processor determines that the particular flow is an elephant flow when the current fill level of the socket buffer reaches a given level.   
     
     
         6 . The source computing device of  claim 5 , wherein the processor is further configured to size the socket buffer based on characteristics of a plurality of flows in the network used for transmission of the particular flow. 
     
     
         7 . The source computing device of  claim 1 , wherein the signal sent by the processor comprises one of:
 a packet belonging to the particular flow in which the processor sets at least one bit in a header of the packet, the at least one bit indicating that the particular flow is an elephant flow, and   a separate signaling packet indicating that the particular flow is an elephant flow.   
     
     
         8 . The source computing device of  claim 1 , wherein:
 in sending the signal into the network, the processor tags a signaling packet for transmission to a central controller in the network.   
     
     
         9 . A non-transitory machine-readable storage medium encoded with instructions executable by a processor of a source computing device for detection of elephant flows, the machine-readable storage medium comprising:
 instructions for monitoring data provided from an application in which a particular flow originates to a socket provided in an operating system hosting the application in the source computing device;   instructions for determining, at the source computing device, based on an amount of data provided to the socket by the application determined from the monitoring, whether the particular flow is an elephant flow; and   instructions for signaling a network used for transmission of the particular flow when it is determined that the particular flow is an elephant flow.   
     
     
         10 . The non-transitory machine-readable storage medium of  claim 9 , wherein the instructions for monitoring, the instructions for determining, and the instructions for signaling are included in instructions of an operating system (OS) of the source computing device. 
     
     
         11 . The non-transitory machine-readable storage medium of  claim 10 , wherein the instructions for monitoring monitor a socket buffer provided by the OS of the source computing device to queue the data provided to the socket by the application. 
     
     
         12 . The non-transitory machine-readable storage medium of  claim 9 , wherein the instructions for monitoring comprise one of:
 instructions for monitoring a rate at which data is provided to the socket,   instructions for monitoring a total amount of data provided to the socket, and   instructions for monitoring a current fill level of a socket buffer provided to queue the data provided to the socket.   
     
     
         13 . A method for detection of elephant flows in a source computing device, the method comprising:
 monitoring, by a shim layer included in an operating system (OS) of the source computing device, an amount of data provided from an application in which a particular flow originates to a socket in the operating system;   determining, at the source computing device, that the particular flow is an elephant flow when the amount of data provided to the operating system exceeds a given threshold; and   transmitting a signal indicating that the particular flow is an elephant flow when it is determined that the particular flow is an elephant flow.   
     
     
         14 . The method of  claim 13 , wherein the monitoring comprises one of:
 monitoring the amount of data as a rate at which data is added to a socket buffer provided by the operating system;   monitoring the amount of data as a total amount of data added to the socket buffer since the particular originated; and   monitoring the amount of data as a current fill level of the socket buffer.   
     
     
         15 . The method of  claim 14 , wherein the socket buffer is a Transmission Control Protocol (TCP) buffer provided by the operating system for transmission of the particular flow.