Elephant flow

An "elephant flow" is a term describing an extremely large (in total bytes) continuous flow set up by a TCP (or even UDP) session measured over a network link. Elephant flows, though not numerous, can occupy a disproportionate share of the total bandwidth over a period of time. It is not clear who coined "elephant flow", but the term began occurring in published Internet network region in 2002 when the observation was made that a small number of flows dominate total Internet traffic [1]. Estimates by researchers Y show that elephant flows on a study among Internet links between Japanese research institutes and universities could occupy Z% of the flow.

The actual impact of elephant flows on Internet traffic is still an area of research and debate. Some research shows that elephant flows may be highly correlated with traffic spikes and other elephant flows[2]. Elephant flows have varying definitions proposed by researchers including flows that occupy greater than 1% of total traffic in a time period (Estan), measuring the duration of the flow (Papagiannaki), and looking at flows whose size is greater than the mean plus three standard deviations of traffic during the time period (Lan)

Fang, W., Peterson, L. "Inter-AS traffic patterns and their implications" Global Telecommunications Conference, 1999. GLOBECOM '99 3, 1859-1868.

K. Papagiannaki, N. Taft, S. Bhattacharyya, P. Thiran, K. Salamatian, C. Diot, "A Pragmatic Definition of Elephants in Internet Backbone Traffic" Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurement, Nov 2002 Pages: 175 - 176

K. Lan and J. Heidemann. On the correlation of internet flow characteristics. Technical Report ISI-TR-574, USC/ISI, 2003.

C. Estan and G. Varghese, "New directions in traffic measurement and accounting," Proceeding of ACM SIGCOMM Internet Measurement Workshop 2001, San Francisco Bay Area, Nov. 2001.