Fast and scalable packet classification

Lunteren, Jan van; Engbersen, Ton

doi:10.1109/jsac.2003.810527

Cited by 154 publications

(79 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…From Eq. (6), if the expected number of hash function calculations approaches 1, the required memory size approaches infinity; in contrast, simulations with a large M h may not give accurate results, due to limited memory size of a computer. This causes the big discrepancy between the numerical result and the simulation result when the average number of hash function calculations per query is close to 1.…”

Section: Simulation Resultsmentioning

confidence: 99%

An efficient data structure for network anomaly detection

Fan

et al. 2008

Security Comm Networks

View full text Add to dashboard Cite

Abstract-Despite the rapid advance in networking technologies, detection of network anomalies at high-speed switches/routers is still far from maturity. To push the frontier, two major technologies need to be addressed. The first one is efficient feature-extraction algorithms/hardware that can match a line rate in the order of Gb/s; the second one is fast and effective anomaly detection schemes. In this paper, we focus on design of efficient data structure and algorithms for feature extraction. Specifically, we propose a novel data structure that extracts socalled two-directional (2D) matching features, which are shown to be effective indicators of network anomalies. Our key idea is to use a Bloom filter array to trade off a small amount of accuracy in feature extraction, for much less space and time complexity, so that our data structure can catch up with a line rate in the order of Gb/s. Different from the existing work, our data structure has the following properties: 1) dynamic Bloom filter, 2) combination of a sliding window with Bloom filter, and 3) using an insertion-removal pair to enhance Bloom filter with a removal operation. Our analysis and simulation demonstrate that the proposed data structure has a better space/time tradeoff than conventional algorithms. For example, for a fixed time complexity, the conventional algorithm (i.e., hash table [1]-[8]) requires a memory of 1.01G bits while our data structure requires a memory of only 62.9M bits, at the cost of losing 1% accuracy in feature extraction.

show abstract

Section: Simulation Resultsmentioning

confidence: 99%

An efficient data structure for network anomaly detection

Fan

et al. 2008

Security Comm Networks

View full text Add to dashboard Cite

show abstract

“…A key advantage of this approach is that it can be easily deployed because it does not require any modification of existing packet classification systems. In comparison, a number of previous interval expansion solutions require hardware and architecture modifications to existing packet classification systems, making their adoption by networking manufacturers and ISPs much less likely [22], [31], [35], [38]. 2.…”

Section: Key Contributionsmentioning

confidence: 99%

“…When a packet comes, the packet needs to be preprocessed according to the reencoding scheme such that the packet, after preprocessing, can be used as a search key for the TCAM. Previous range encoding schemes fall into two categories: database-independent encoding schemes [6], [22], where the encoding of each rule is independent of other rules in the classifier, and database-dependent encoding schemes [7], [31], [34], [38], where the encoding of each rule may depend on other rules in the classifier. While the TCAM circuit does not need to be modified to implement range encoding, the system hardware does need to be reconfigured to allow for preprocessing of packets, and the delay caused by packet preprocessing could be problematic.…”

Section: Related Workmentioning

confidence: 99%

Complete Redundancy Removal for Packet Classifiers in TCAMs

Liu

Gouda

2010

IEEE Trans. Parallel Distrib. Syst.

View full text Add to dashboard Cite

Abstract-Packet classification is the core mechanism that enables many networking services on the Internet such as firewall packet filtering and traffic accounting. Using Ternary Content Addressable Memories (TCAMs) to perform high-speed packet classification has become the de facto standard in the industry. TCAMs classify packets in constant time by comparing a packet with all classification rules of ternary encoding in parallel. Despite their high speed, TCAMs suffer from the well-known interval expansion problem. As packet classification rules usually have fields specified as intervals, converting such rules to TCAM-compatible rules may result in an explosive increase in the number of rules. This is not a problem if TCAMs have large capacities. Unfortunately, TCAMs have very limited capacity, and more rules means more power consumption and more heat generation for TCAMs. Even worse, the number of rules in packet classifiers have been increasing rapidly with the growing number of services deployed on the Internet. In this paper, we propose to address the interval expansion problem of TCAMs by removing redundant rules in classifiers. This equivalent transformation can significantly reduce the number of TCAM entries needed by a classifier. Our experiments on real-life classifiers show an average reduction of 58.2 percent in the number of TCAM entries by removing redundant rules. Given the logical interleaving nature of packet filtering rules, identifying redundant rules in classifiers is by no means trivial, and to achieve the guarantee of no redundant rules in resulting classifiers is even more challenging. In this paper, for the first time, we give a necessary and sufficient condition for identifying all redundant rules in a classifier. Based on this condition, we categorize redundant rules into upward redundant rules and downward redundant rules. Second, we present two algorithms for detecting and removing the two types of redundant rules, respectively. Third, we formally prove that the resulting classifiers have no redundant rules after running the two algorithms. Last, we conduct extensive experiments on both real-life and synthetic classifiers. The experimental results show that our redundancy removal algorithms are both effective and efficient.

show abstract

“…Therefore, there is redundancy between their parent nodes (two F 2 ). In this case, we delete the [5,9]) so that it becomes the second field range of the first leaf node as shown in Fig. 5(b).…”

Section: Minimum Range Treementioning

confidence: 99%

Tree-Based Minimization of TCAM Entries for Packet Classification

Sun

Kim

2010

2010 7th IEEE Consumer Communications and Networking Conference

View full text Add to dashboard Cite

Abstract-Packet classification is a fundamental task for network devices such as edge routers, firewalls, and intrusion detection systems. Currently, most vendors use Ternary Content Addressable Memories (TCAMs) to achieve high-performance packet classification. TCAMs use parallel hardware to check all rules simultaneously. Despite their high speed, TCAMs have a fundamental in dealing with ranges efficiently. Many packet classification rules contain range specifications, each of which needs to be translated into multiple prefixes to store in TCAMs. Such translation may result in an explosive increase in the number of required TCAM entries. In this paper, we propose a redundancy removal algorithm using a tree representation of rules. The proposed algorithm removes redundant rules and combines overlaying rules to build an equivalent, smaller rule set for a given packet classifier. This equivalent transformation can significantly reduce the number of required TCAM entries. Our experiments show a reduction of 70.9% in the number of TCAM entries. Besides, our algorithm eliminates requirement of priority encoder circuits. It can also be used as a preprocessor, in tandem with other methods, to achieve further performance imrpovement.

show abstract

Fast and scalable packet classification

Cited by 154 publications

References 22 publications

An efficient data structure for network anomaly detection

An efficient data structure for network anomaly detection

Complete Redundancy Removal for Packet Classifiers in TCAMs

Tree-Based Minimization of TCAM Entries for Packet Classification

Contact Info

Product

Resources

About