Routers classify packets to determine which flow they belong to, and to decide what service they should receive. Classification may, in general, be based on an arbitrary number of fields in the packet header. Performing classification quickly on an arbitrary number of fields is known to be difficult, and has poor worst-case performance. In this paper, we consider a number of classifiers taken from real networks. We find that the classifiers contain considerable structure and redundancy that can be exploited by the classification algorithm. In particular, we find that a simple multi-stage classification algorithm, called RFC (recursive flow classification), can classify 30 million packets per second in pipelined hardware, or one million packets per second in software.

Associative memories offer high levels of parallelism in matching a query against stored entries. We design and analyze an architecture which uses a single lookup into a Ternary Content Addressable Memory (TCAM) to solve the subset query problem for small sets, i.e., to check whether a given set (the query) contains (or alternately, is contained in) any one of a large collection of sets in a database. We use each TCAM entry as a small Ternary Bloom Filter (each 'bit' of which is one of {0,1," * " }) to store one of the sets in the collection. Like Bloom filters, our architecture is susceptible to false positives. Since each TCAM entry is quite small, asymptotic analyses of Bloom filters do not directly apply. Surprisingly, we are able to show that the asymptotic false positive probability formula can be safely used if we penalize the small Bloom filter by taking away just one bit of storage and adding just half an extra set element before applying the formula. We believe that this analysis is independently interesting.The subset query problem has applications in databases, network intrusion detection, packet classification in Internet routers, and Information Retrieval. We demonstrate our architecture on one illustrative streaming application -intrusion detection in network traffic. By shingling the strings in the database, we can perform a single subset query, and hence a single TCAM search, to skip many bytes in the stream. We evaluate our scheme on the open source CLAM anti-virus database, for worst-case as well as random streams. Our architecture appears to be at least one order of magnitude faster than previous approaches. Since the individual Bloom filters must fit in a single TCAM entry (currently 72 to 576 bits), our solution applies only when each set is of a small cardinality. However, this is sufficient for many typical applications. Also, recent algorithms for the subset-query problem use a small-set version as a subroutine.

Methods:We initially determined whether pseudovirus-Envs from transmitted founders (TF) had enhanced DC-SIGN binding, trans-infection and increased IL-10 secretion over matched chronic Envs. As DC-SIGN interactions with Env favors high mannose N-glycans, we also deleted gp120 PNGs bearing high mannose glycans either singly, or in combination, in matched CAP239 Env T/F and chronic clones. Results: T/F Envs induced more IL-10 secretion than chronic controls. When PNGs were deleted from the CAP239 envs, the effect on pseudovirion entry, DC-SIGN binding and transinfection was clone specific, suggesting that specific N-glycans affect Env function differently in different clones. For example deletion of PNG 448 reduced entry efficiency, DC-SIGN binding and trans-infection of TF by *50% when compared to wild type, while either enhancing or maintaining these phenotypes in the chronic infection clone. Only deletion of the PNG 241 reduced IL-10 induction for T/F clones. Conclusions: As pseudovirion entry efficiencies of most PNG mutants were reduced for both CAP239 Env clones, it is difficult to determine the role that each might play in DC-SIGN interactions. However, the TF Envs induced MDDCs to secrete higher levels of IL-10 compared to matched chronic infection controls, suggesting that localized anti-inflammatory responses in the genital epithelium might play a role in HIV transmission.