Elephant flows

An elephant flow is an extremely large network connection that

  • consists of long-running connections set up by TCP or other protocols measured over a network link,

  • measures larger than 1 GB per 10 seconds by default, and

  • can cause performance duress or issues in Snort cores by consuming excessive CPU resources.

Impact on system performance

Elephant flows can potentially consume an excessive amount of CPU resources and impact other competing flows for detection resources and cause issues, such as increased latency or packet drops.