## 1 Introduction  
With the recent diversity of IT devices and the growth of multimedia services, Internet traffic has increased explosively, causing traffic pattern changes and the surging of network loads, which result in the decline of service quality. This is due to the technological limits under which the current rigid and closed Internet network architecture operates. This architecture is complex to manage, and it is difficult to create a new service as the current Internet cannot flexibly cope with expanding network capacity. In order to tackle this problem, networks should be open with virtual software computation and the Software Defined Network (SDN) is a technology achieving these aims [1, 2]. The SDN decouples data and control layers, unlike the traditional Internet architecture where data and control layers exist together. In SDNs, a controller in the control layer carries out basic functions for a centralized network control such as forwarding control, management of topology and resource states and routing control based on a global view on the network state. It flexibly operates networks through software by determining differentiated forwarding and packet processing rules for upper-layer application services and sending them to lower-layer SDN switches. The SDN switches do not need to implement or operate the existing complex protocol. They are simple because they only have to perform instructions from the SDN controller at the control layer [3, 4]. In the SDN, packets are handled in a flow unit. The flow entries are generated by controller and managed in the flow table of the switch based on the packets-related information, such as packet source, destination and processing methods. If the switch receives the packets, it uses the packet information to search the matching flow entries with the corresponding packets from the flow table and takes corresponding actions, such as forwarding, modification and removal of packets. When a corresponding flow entry does not exist, the switch generates a flow entry that contains new information by communicating with the controller. This flow table is managed within the limited memory capacity of the switch. The flow table consists of Ternary Content Addressable Memory (TCAM) which is expensive and high power-consuming. The number of flows can be more than 8 million in typical enterprise networks so that the flow table cannot contain all of flow entries at the same time [5; 6; 7]. Moreover, it is hard to configure a network with switches of the same memory capacity when the network scale becomes large and, thus, different switches of many vendors are used to configure one. In this case, switches with relatively low performance can bring about frequent flow entry replacements in the packet forwarding process. It can cause more packet forwarding delay and controller load increase, which can decline the performance of the entire network and degraded user's Quality of Service (QoS) [8; 9; 10]. Hence, reducing the number of the flow entry replacement and controller overhead is very important in the SDN. The main contributions of our paper are summarized as follows. * We describe what happens when the flow table is overflowed. We explain the operation of the switch and the controller, and show how they communicate with each other through the OpenFlow protocol messages. * We propose a new flow entry replacement scheme to reduce the chance of overflowing the flow table. The proposed Short Flow First (SFF) scheme identifies the flow characteristics using matching periods of each flow entry and manages the flow entries based on the characteristics. It decreases the processing and message exchanging overheads. * We implement the SFF and the typical flow entry replacement schemes such as First-In-First-Out (FIFO), Least Frequently Used (LFU) and Least Recently Used (LRU), on the switch code. The proposed scheme does not require the change of the switch architecture. It just needs to modify the code of data structure of the flow table at the switch.