With the ever increasing amount of traffic, scalability is probably the most important factor that differentiates several existing approaches to traffic classification. This paper focuses on payload-based classification and compares the results obtained through a "lightweight" traffic classification approach with the ones obtained with a "completely stateful" approach, demonstrating that the first approach, albeit less precise, is still appropriate for a large class of applications.

Despite its efficiency, the general approach of hardcoding protocol format descriptions in packet processing applications suffers from many limitations. Among the others, the lack of flexibility when needing to extend the software for supporting new protocols, and the proliferation of modules with similar functionality between different applications, resulting in decreased maintainability. The NetPDL language was defined for overcoming such limitations, allowing decoupling applications from the knowledge of the format of protocol headers. The main criticism to NetPDL relates to its supposed performance penalties; this paper demonstrates that this language can be effectively used for the dynamic generation of optimized, i.e. efficient and fast, packet-processing code, and presents the architecture of a compiler implemented for such purpose.

Network processors are special-purpose programmable units deployed in many modern high-speed network devices, which combine flexibility and high performance. However, software development for these platforms is traditionally cumbersome due both to the lack of adequate programming abstractions and to the impossibility of reusing the same software on different hardware platforms.In this context, the Network Virtual Machine (NetVM) aims at defining an abstraction layer for the development of portable and efficient data-plane packet processing applications. Portability and efficiency are achieved altogether by virtualizing the hardware and by capturing in the programming model the peculiar characteristics of the application domain.This paper validates the NetVM model, demonstrating that the proposed abstraction coupled with a proper implementation of the NetVM Framework is able to provide generality (i.e., capability to support a wide range of applications), software portability across heterogeneous network processor architectures, and efficiency of the generated code, often exceeding the one obtained using state-of-the-art compilers.

While in computer networks the number of possible protocol encapsulations is growing day after day, network administrators face ever increasing difficulties in selecting accurately the traffic they need to inspect. This is mainly caused by the limited number of encapsulations supported by currently available tools and the difficulty to exactly specify which packets have to be analyzed, especially in presence of tunneled traffic. This paper presents a novel packet processing language that, besides Boolean filtering predicates, introduces special constructs for handling the more complex situations of tunneled and stacked encapsulations, giving the user a finer control over the semantics of a filtering expression. Even though this language is principally focused on packet filters, it is designed to support other advanced packet processing mechanisms such as traffic classification and field extraction.

It is a common belief that using a virtual machine for portable executions of data-plane packet-processing applications would introduce too many penalties in terms of performance, because of the assumed overhead caused by the presence of a hardware abstraction layer. Even if common sense proves true in the case of general purpose virtual machines, such as the JVM and the CLR, it may be wrong in case of a special-purpose network-oriented virtual machine. This paper describes the architecture of a runtime environment and a compiler infrastructure for the Network Virtual Machine (NetVM), showing that the portability of packetprocessing programs can be achieved without additional penalties even over heterogeneous platforms. Our implementation supports three different target architectures: one with a general purpose processor (Intel x86), one with a multi-core network processor (Cavium Octeon) and one with a systolic-array network processor (Xelerated X11), and shows that the NetVM model (i) is able to abstract such heterogeneous platforms and (ii) enables the exploitation of hardware functionalities provided by the specific architecture; finally, it demonstrates that the performances of NetVM programs compiled into native code are comparable to those obtained using commercial general purpose compilers.