Performance Evaluation of HyperLogLog for In-Network Flow Cardinality Estimation on P4-Programmable Switches

Network traffic monitoring requires efficient cardinality estimation to count distinct flows for applications such as anomaly detection and traffic engineering. Traditional exact counting approaches are memory-intensive and do not scale to high-speed networks. Probabilistic algorithms like HyperLogLog (HLL) offer memory-efficient alternatives by trading exact accuracy for space efficiency. This thesis presents a performance evaluation of HyperLogLog for in-network flow cardinality estimation on P4-programmable switches. We implement an optimized HLL variant on Intel Tofino hardware using the P4₁₆ programming language, focusing on developing a robust monitoring framework for systematic performance assessment under both synthetic and real network traffic. We design an experimental methodology that includes: (1) a monitoring infrastructure with exponential random sampling for state observation, (2) ground truth validation using hardware counters, (3) synthetic traffic generation at controlled rates, and (4) trace replay capabilities for real-world traffic patterns. The system supports configurable monitoring intervals and deterministic reset periods ensuring accurate comparison between HLL estimates and ground truth. This work demonstrates the practical viability of probabilistic cardinality estimation in programmable network hardware, providing empirical insights into accuracy-performance trade-offs and establishing a reproducible methodology for evaluating sketch-based algorithms in production network environments.