QoS-aware firewall session table

Abstract

Packet classification is the process of matching multiple packet header fields against a possibly large set of filters to find a matching rule. Packet classification was implemented in several application areas such as service differentiation, firewalls, QoS and secure routing. In this paper, we extend the firewall session table to speed up QoS marking process, and thus, to save QoS Classification time. Our proposed algorithm and system have been implemented in the kernel of NetBSD. Experimental tests show that the new implementation can save about 10 μsec per packet if a QoS classification of 10000 filters is used. Moreover, the new implementation needs just less than 0.5 μsec to mark packet regardless of the size of the filtering rules. To evaluate the performance of our new implementation with respect to the QoS characteristics, we measured four important QoS metrics (throughput, packet loss rate, delay and jitter) and compared them with the classical implementation. We finally demonstrate that a significant enhancement is remarked using our new algorithm.

Compu Castel: An Instructional Tool for Teaching Firewall Concepts

“…The information exists on packet header fields used to search the filtering rule staring form the first rule in a sequential order. The action associated with the first matching rule is performed [13]. Therefore, the order of the rules is very significant.…”