PSketch: A Priority-Aware Sketch Architecture for Real-Time Flow Monitoring via eBPF
By: Yuanjun Dai, Qingzhe Guo, Xiangren Wang
Potential Business Impact:
Tracks internet data better, faster, and cheaper.
Sketch-based monitoring in SDN often suffers from tightly coupled pipeline and memory constraints, limiting algorithmic flexibility and reducing accuracy. We propose PSketch, the first in-kernel priority-aware sketching framework implemented with eBPF. It ensures lossless tracking of high-priority flows via a hash-based table and approximates top-k elephant flows using a sketch pipe. PSketch supports both TCP and UDP and enables in-kernel retransmission tracking with minimal overhead. Unlike SDN-based approaches, it runs on commodity Linux systems, removing hardware dependencies. We perform evaluation on 10 Gbps CAIDA traces. Results show that PSketch achieves 96.0% top-k detection accuracy, 96.4% retransmission recall, and only 0.7% throughput degradation.
Similar Papers
PSSketch: Finding Persistent and Sparse Flow with High Accuracy and Efficiency
Data Structures and Algorithms
Finds hidden dangers in computer traffic faster.
eHashPipe: Lightweight Top-K and Per-PID Resource Monitoring with eBPF
Performance
Shows exactly which computer parts are busy.
A streaming algorithm and hardware accelerator for top-K flow detection in network traffic
Networking and Internet Architecture
Finds biggest data streams fast, even in huge networks.