Cisco Firepower Threat Defense: SNORT3 - Elephant Flows
An Elephant Flow is a single session, relatively long running network connection that consumes a large or disproportionate amount of bandwidth. This type of flow is assigned to one Snort instance, therefore impacts performance. Once identified we can move these flows to a pre-filter policy foscuing on L3/4 controls