Traffic flow classification

A method for detecting large flows in a data-center network comprising:

• provisioning a library to an end host communicatively coupled to a data-center network, the library comprising a send function operable to send frames/packets from a socket at the end host and to capture classification information related to the frames/packets;
• collecting, from within a user space at the end host, classification information collected by the send function for a traffic flow;
• comparing the classification information for the traffic flow to a flow metric value;
• and
• classifying the traffic flow as a large flow where a value in the classification information achieves the flow metric value.

A system for classifying traffic flows comprising:

• an end host communicatively coupled to a data-center network;
• an operating system residing at the end host;
• a traffic agent residing within a user space at the end host independent of a kernel space of the operating system, a library within the traffic agent;
• an altered send function, within the library, the altered send function altered to copy classification information from a call of the send function enabling the traffic agent to:
• monitor a traffic flow generated at the end host for a period of time;
• compile classification information for the traffic flow;
• the traffic agent further operable to:
• compare the classification information to a metric value;
• and
• classify the traffic flow as an elephant flow where the classification information achieves a predetermined level relative to the metric value.