Sketch-based monitoring in SDN often suffers from tightly coupled pipeline and memory constraints, limiting algorithmic flexibility and reducing accuracy. We propose PSketch, the first in-kernel priority-aware sketching framework implemented with eBPF. It ensures lossless tracking of high-priority flows via a hash-based table and approximates top-k elephant flows using a sketch pipe. PSketch supports both TCP and UDP and enables in-kernel retransmission tracking with minimal overhead. Unlike SDN-based approaches, it runs on commodity Linux systems, removing hardware dependencies. We perform evaluation on 10 Gbps CAIDA traces. Results show that PSketch achieves 96.0% top-k detection accuracy, 96.4% retransmission recall, and only 0.7% throughput degradation.
@article{arxiv.2509.07338,
title = {PSketch: A Priority-Aware Sketch Architecture for Real-Time Flow Monitoring via eBPF},
author = {Yuanjun Dai and Qingzhe Guo and Xiangren Wang},
journal= {arXiv preprint arXiv:2509.07338},
year = {2025}
}