  Monitoring tasks, such as anomaly and DDoS detection, require identifying
frequent flow aggregates based on common IP prefixes. These are known as
\emph{hierarchical heavy hitters} (HHH), where the hierarchy is determined
based on the type of prefixes of interest in a given application. The per
packet complexity of existing HHH algorithms is proportional to the size of the
hierarchy, imposing significant overheads.
  In this paper, we propose a randomized constant time algorithm for HHH. We
prove probabilistic precision bounds backed by an empirical evaluation. Using
four real Internet packet traces, we demonstrate that our algorithm indeed
obtains comparable accuracy and recall as previous works, while running up to
62 times faster. Finally, we extended Open vSwitch (OVS) with our algorithm and
showed it is able to handle 13.8 million packets per second. In contrast,
incorporating previous works in OVS only obtained 2.5 times lower throughput.
