How elephant flows work

Summary

The key components involved in the elephant flow process are:

  • System detection: Monitors for Snort duress conditions based on configured parameters.

  • Flow identification: Determines when a flow qualifies as an elephant flow.

  • CPU monitoring: Tracks CPU utilization against configured thresholds.

  • Bypass action: Allows traffic for trusted applications to pass without Snort inspection.

  • Throttle action: Reduces the flow throughput in 10 percent increments until CPU utilization drops below the threshold.

Workflow

Elephant flow workflow
The elephant flow workflow illustrates the stages of processing elephant flows, including flow identification, CPU monitoring, and actions taken to manage traffic based on CPU utilization thresholds.

These stages describe how elephant flows are processed:

  1. The system continuously monitors traffic flows and applies intrusion policy processing to all flows, including potential elephant flows, ensuring that attacks are detected early in connections.
  2. When an elephant flow is detected based on configured parameters, the system evaluates whether a Snort duress condition exists by checking CPU utilization and time window parameters. No action is taken unless the system detects a Snort duress condition (performance issue). The system does not throttle or bypass a flow just because it is large.
  3. If duress conditions are met, the system determines whether to bypass or throttle the elephant flow based on configuration settings. The actions of throttle and bypass are mutually exclusive. This means that you can either bypass or throttle a flow, but not both.
  4. For bypass actions, if configured for specific applications only, the system allows trusted application flows to pass without Snort inspection while throttling remaining flows causing duress. This ensures that other non-trusted application flows still receive full Snort inspection, although their bandwidth is reduced.
  5. For throttle actions, the system reduces flow throughput in 10 percent increments until CPU utilization reduces to below the configured threshold.