PSketch: A Priority-Aware Sketch Architecture for Real-Time Flow Monitoring via eBPF

Abstract

Sketch-based monitoring in SDN often suffers from tightly coupled pipeline and memory constraints, limiting algorithmic flexibility and reducing accuracy. We propose PSketch, the first in-kernel priority-aware sketching framework implemented with eBPF. It ensures lossless tracking of high-priority flows via a hash-based table and approximates top-k elephant flows using a sketch pipe. PSketch supports both TCP and UDP and enables in-kernel retransmission tracking with minimal overhead. Unlike SDN-based approaches, it runs on commodity Linux systems, removing hardware dependencies. We perform evaluation on 10 Gbps CAIDA traces. Results show that PSketch achieves 96.0% top-k detection accuracy, 96.4% retransmission recall, and only 0.7% throughput degradation.