Scalable packet classification

Baboescu, Florin; Varghese, George

doi:10.1109/tnet.2004.842232

Cited by 191 publications

(118 citation statements)

References 12 publications

Supporting

Mentioning

117

Contrasting

Order By: Relevance

“…However, when N becomes larger, the average performance of ABV scheme is improved, and n abv is expected to be less than N/w p . The evaluation results in [4] indicate that ABV scheme outperforms BV scheme by an order of magnitude on both industrial firewall and synthetic rule sets [4] . In the proposed ERFC, the evaluation results show that, using hash-based ABV scheme, the average preprocessing time is reduced by about 25% and 50% (respectively when N = 10000 and 30000) in comparison with the hash scheme without ABV.…”

Section: High-speed Preprocessingmentioning

confidence: 99%

“…In Lucent Bit Vector (BV) search scheme [3] , storage requirement is O(kN 2 ) and query time is O(Wk + N/w) in the worst case, where N is the number of rules, W is the length of IP address, w is memory bus width. The Aggregated Bit Vector [4] (ABV) scheme adds new techniques to the BV scheme, and reports an order of magnitude improvement on performance over BV scheme. The tuple space search (TSS) [5] has a small memory requirement O(N ), but its search speed in the worst case depends on characteristics of classifier and it supports only prefixes rather than arbitrary ranges.…”

Section: Related Workmentioning

confidence: 99%

“…In order to improve operation performance of comparing bit vectors and computing intersection (bitwise AND) of bit vectors, a new hash-based aggregated bit vector structure which combines the advantages of ABV [4] and hash schemes is proposed in the preprocessing of ERFC. In this scheme, ABV is exploited to speed up intersection calculation of bit vectors; and a hashbased algorithm is used to improve the performance of bit vector comparing and searching.…”

Section: High-speed Preprocessingmentioning

confidence: 99%

“…Synthetic databases should provide characteristics which are similar to real life databases. In many recent related research activities [2,4,[10][11][12][13][14][15] , characteristics of diverse real life rule sets have been analyzed, and approaches to generate test rule set are proposed.…”

Section: Test Rule Setmentioning

confidence: 99%

See 3 more Smart Citations

ERFC: An Enhanced Recursive Flow Classification Algorithm

Gong

Wang

Cheng

2010

J. Comput. Sci. Technol.

View full text Add to dashboard Cite

Packet classification on multi-fields is a fundamental mechanism in network equipments, and various classification solutions have been proposed. Because of inherent difficulties, many of these solutions scale poorly in either time or space as rule sets grow in size. Recursive Flow Classification (RFC) is an algorithm with a very high classifying speed. However, its preprocessing complexity and memory requirement are rather high. In this paper, we propose an enhanced RFC (ERFC) algorithm, in which a hash-based aggregated bit vector scheme is exploited to speed up its preprocessing procedure. A compressed and cacheable data structure is also introduced to decrease total memory requirement and improve its searching performance. Evaluation results show that ERFC provides a great improvement over RFC in both space requirement and preprocessing time. The search time complexity of ERFC is equivalent to that of RFC in the worst case; and its average classifying speed is improved by about 100%.

show abstract

Section: High-speed Preprocessingmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: High-speed Preprocessingmentioning

confidence: 99%

Section: Test Rule Setmentioning

confidence: 99%

See 2 more Smart Citations

ERFC: An Enhanced Recursive Flow Classification Algorithm

Gong

Wang

Cheng

2010

J. Comput. Sci. Technol.

View full text Add to dashboard Cite

show abstract

“…Aggregated Bit Vector (ABV) is a rule aggregation scheme to enhance scalability (Baboescu and Varghese 2005) based on the observation that existing solutions based on two-field classifications, usually source and destination addresses, do not scale well in one of time or storage on more general cases, where more fields are involved. BPF+ is a framework (Begel et al 1999) to explore the trade-off between flexibility and performance in packet filtering.…”

Section: Relevance Of Performancementioning

confidence: 99%

A formal logic approach to firewall packet filtering analysis and generation

2008

View full text Add to dashboard Cite

Recent years have seen a significant increase in the usage of computers and their capabilities to communicate with each other. With this has come the need for more security and firewalls have proved themselves an important piece of the overall architecture, as the body of rules they implement actually realises the security policy of their owners. Unfortunately, there is little help for their administrators to understand the actual meaning of the firewall rules. This work shows that formal logic is an important tool in this respect, because it is particularly apt at modelling real-world situations and its formalism is conductive to reason about such a model. As a consequence, logic may be used to prove the properties of the models it represents and is a sensible way to go in order to create those models on computers to automate such activities. We describe here a prototype which includes a description of a network and the body of firewall rules applied to its components. We were able to detect a number of anomalies within the rule-set: inexistent elements (e.g. hosts or services on destination components), redundancies in rules defining the same action for a network and hosts belonging to it, irrelevance as rules would involve traffic that would not pass through a filtering device, and contradiction in actions applied to elements or to a network and its hosts. The prototype produces actual firewall rules as well, generated from the model and expressed in the syntax of IPChains and Cisco's PIX.

show abstract

Network Traffic Management

Chen

2007

Handbook of Computer Networks

View full text Add to dashboard Cite

Network resources are shared as needed by a community of users. Without effective traffic controls, networks are vulnerable to possible congestion when the offered traffic exceeds the network capacity, leading to serious deterioration of network performance. This chapter gives an overview of traffic control methods and their underlying principles. The main preventive controls are admission control and access regulation (policing). They seek to avoid congestion by limiting the amount of traffic entering the network. Within the network, packets may have different requirements for reliable or timely delivery. These requirements are recognized by packet scheduling and buffer management algorithms implemented in switches and routers. At the transport layer, protocols such as TCP can adapt their traffic rate to the level of congestion.Finally, this chapter covers the question of measurement and verification of network performance.

show abstract

Scalable packet classification

Cited by 191 publications

References 12 publications

ERFC: An Enhanced Recursive Flow Classification Algorithm

ERFC: An Enhanced Recursive Flow Classification Algorithm

A formal logic approach to firewall packet filtering analysis and generation

Network Traffic Management

Contact Info

Product

Resources

About