Algorithms for advanced packet classification with ternary CAMs

Abstract

Ternary content-addressable memories (TCAMs) have gained wide acceptance in the industry for storing and searching Access Control Lists (ACLs). In this paper, we propose algorithms for addressing two important problems that are encountered while using TCAMs: reducing range expansion and multi-match classification .Our first algorithm addresses the problem of expansion of rules with range fields to represent range rules in TCAMs, a single range rule is mapped to multiple TCAM entries, which reduces the utilization of TCAMs. We propose a new scheme called Database Independent Range PreEncoding (DIRPE) that, in comparison to earlier approaches, reduces the worst-case number of TCAM entries a single rule maps on to. DIRPE works without prior knowledge of the database, scales when a large number of ranges is present, and has good incremental update properties.Our second algorithm addresses the problem of finding multiple matches in a TCAM. When searched, TCAMs return the first matching entry; however, new applications require either the first few or all matching entries. We describe a novel algorithm, called Multi-match Using Discriminators (MUD), that finds multiple matches without storing any per-search state information in the TCAM, thus making it suitable for multi-threaded environments. MUD does not increase the number of TCAM entries needed, and hence scales to large databases.Our algorithms do not require any modifications to existing TCAMs and are hence relatively easy to deploy. We evaluate the algorithms using real-life and random databases.

PC-DUOS: Fast TCAM lookup and update for packet classifiers

“…Figure 5. Number of TCAM writes in PC-DUOS and STCAM using DIRPE [3] cant improvement in update processing time is seen for the test1, which is faster by 329 times for the prefix representation scheme and 308 times faster that the STCAM scheme when DIRPE is used. The test1 is derived from a seed file for access control lists.…”

“…Ranges may be handled in one of many ways. In this paper, we consider first the simple encoding of a range by a set of prefixes [3,2]. This encoding is well suited for a binary trie representation.…”

“…This encoding is well suited for a binary trie representation. Next, we consider the DIRPE scheme of [3] that requires the use of a multibit trie. Our methodology may also be applied to other range encoding schemes [11,12].…”

“…The first set uses prefix expansion of ranges [3,2], whereas the second set uses DIRPE [3] for representing source and destination port ranges. DIRPE is implemented by introducing multi-bit tries for source and destination port ranges.…”

PC-DUOS+: A TCAM Architecture for Packet Classifiers

“…Various approaches have been proposed in the literature to alleviate the range expansion problem. The schemes in [3], [14], [12], [17], [18], [19], [26] encode the ranges and store modified rules in the TCAM. As a packet arrives, an encoded search key is created from the packet header fields using the encoding algorithm and the TCAM is searched using the encoded search key.…”