Counting network flows in real time

We are concerned with the problem of counting the distinct flows on a high speed network link. Flow counting programs, which must peek at all incoming packets, must run very quickly in order to keep up with the high packet arrival rates of modern networks. Previous approaches for flow counting based on bitmap algorithms can underestimate the number of flows. We propose a new timestamp-vector algorithm that retains the fast estimation and small memory requirement of the bitmap-based algorithms, while reducing the possibility of underestimating the number of active flows.