Efficient packet classification on network processors

Abstract

SUMMARYAlways-on networking and a growing interest in multimedia-and conversational-IP services offer an opportunity to network providers to participate in the service layer, if they increase functional intelligence in their networks. An important prerequisite to providing advanced services in IP access networks is the availability of a high-speed packet classification module in the network nodes, necessary for supporting any IP service imaginable. Often, access nodes are installed in remote offices, where they terminate a large number of subscriber lines. As such, technology adding processing power in this environment should be energy-efficient, whilst maintaining the flexibility to cope with changing service requirements. Network processor units (NPUs) are designed to overcome these operational restrictions, and in this context this paper investigates their suitability for wireline and robust packet classification in a firewalling application. State-of-the-art packet classification algorithms are examined, whereafter the performance and memory requirements are compared for a Binary Decision Diagram (BDD) and sequential search approach. Several space optimizations for implementing BDD classifiers on NPU hardware are discussed and it is shown that the optimized BDD classifier is able to operate at gigabit wirespeed, independent of the ruleset size, which is a major advantage over a sequential search classifier.

DNS tunneling detection through statistical fingerprints of protocol messages and machine learning

“…Packets are parsed at the TCP/IP level, and then their content is analyzed in detail; data are extracted and stored in a buffer until the message is completely rebuilt; then, attachments are completely decoded according to MIME, and an antivirus algorithm is applied. These appliances are usually guaranteed for incoming traffic up to 2 Gbps (e.g., by Sonicwall NSA E8500 classification at gigabit wirespeed can be found in [25]. Overall, we can conclude that our traffic monitoring system can be easily employed in real time at the network level for DNS monitoring.…”

“…Again the Bayes detector is taken as a reference as it was the resulting universal detector from the previous analysis. Another example of packet classification at gigabit wirespeed can be found in [25]. It must be noted that the time for reading the used DNS traces is negligible with respect to the computation of the features.…”

Multi-match Packet Classification Scheme Combining TCAM with an Algorithmic Approach

“…The Bloom filter size, M , is assumed to be 32 bits, which is four times Table 1. The number of hash indices programming the Bloom filter is equal to three, according to (2). In this example, we arbitrarily select a set of bits as hash indices.…”