Packet Classification # 3
Paper List
[Bit-Parallelism]
- T. Lakshman, D. Stiliadis, "High-Speed Policy-based Packet Forwarding Using Efficient Multi-dimensional Range Matching"
F. Baboescu, G. Varghese, "Scalable Packet Classification" [ABV: Agregated Bit Vector]M. Buddhikot, S. Suri, M. Waldvogel, "Space Decomposition Techniques for Fast Layer-4 Switching" [Space Decomposition]V. Srinivasan, G. Varghese, S. Suri, M. Waldvogel, "Fast and Scalable Layer Four Switching" [Layer4]
The ability to provide differentiated services to users with widely varying requirements is becoming increasingly important, and Internet Service Providers would like to provide these differentiated services using the same shared network infrastructure. The key mechanism, that enables differentiation in a connectionless network, is the packet classification function that parses the headers of the packets, and after determining their context, classifies them based on administrative policies or real-time reservation decisions. Packet classification, however, is a complex operation that can become the bottleneck in routers that try to support gigabit link capacities.
The presented filtering or classification schemes can be used to classify packets for security policy enforcement, applying resource management decisions, flow identification for RSVP reservations, multicast look-ups, and for source-destination and policy based routing. The scalability and performance of the algorithms have been demonstrated by implementation and testing in a prototype system.
Hardware solutions such as TCAMs do not scale to large classifiers. However,even for large classifiers(say 100,000 rules),any packet is likely to atch a few (say 10)rules. This paper seeks to exploit this observation to produce a scalable packet classi fication scheme called Aggregated Bit Vector (ABV). This paper takes the bit vector search algorithm (BV, which takes linear time) described by Lakshman et al in the paper "High speed policy-based packet forwarding using efficient multi-dimensional range matching". They add two new ideas,recursive aggregation of bit aps and filter rearrangement,to create ABV (which can take logarithmic time for many databases).We show that ABV outperforms BV by an order of agnitude using simulations on both industrial firewall databases and synthetically generated databases. A new scheme, based on space
decomposition is presented. Its search time is
comparable to the best existing schemes, but which also offers fast worst-case filter update time.
The three key ideas in this algorithm are as follows:
(1) innovative data-structure based on quadtrees for a hierarchical representation of the recursively decomposed search space,
(2) fractional cascading and pre-computation to improve packet classification time, and
(3) prefix partitioning to improve update time. Depending on the actual requirements of the system this algorithm is deployed in, a single parameter can be used to tradeoff search time for update time.
Also, this algorithm is amenable to fast software and hardware implementation.
In Layer Four switching, the route and resources allocated to a packet are determined by the destination address as well as other header fields of the packet such as source address, TCP and UDP port numbers. Layer Four switching unifirewall processing, RSVP style resource reservation filters,QoS Routing, and normal unicast and multicast forwarding into a single framework. In this framework, the forwardingdatabase of a router consists of a potentially large number of filters on key header fields. A given packet header can match multiple filters, so each filter is given a cost, and the packet is forwarded using the least cost matching filter.
In this paper, two new algorithms for solving the least cost matching filter problem at high speeds are described.
-First algorithm is based on a grid-of-tries construction and works optimally for processing filters consisting of two prefix fields (such as destination-source filters) using linear space.
-Second algorithm, cross-producting, provides fast lookup times for arbitrary filters but potentially requires large storage. We describe a combination scheme that combines the advantages of both schemes. The combination scheme can be optimized to handle pure destination prefix filters in 4 memory accesses, destination-source filters in 8 memory accesses worst case, and all other filters in 11 memory accesses in the typical case.
References
1-Bit-Parallelism
2-Agregated Bit Vector
3-Space Decomposition