As networks expanded largely and link speeds grow rapidly, keeping a counter for each flow is too expensive. Estan et al. propose two algorithms: sample and hold and multistage filters, to identify large flows, which have obvious shortcomings: sample and hold discard packets randomly while multistage filters simultaneously calculate 5～6 hash functions that is unsuitable for hardware implementation. This paper proposes two algorithms, Hits and Holds, to identify large flows quickly and correctly, which overcome the shortcomings of Estan’s algorithms, while effectively reducing false positive and false negative errors.