EQC16: An optimized packet classification algorithm for large rule-sets

Abstract

Packet classification is a well-researched field. However, none of the existing algorithms works well for very large rule-sets up to 128K rules. Further with the advent of IPv6, number of rule field bytes is going to increase from around 16 to 48. With higher number of field bytes, both memory usage and classification speed is affected badly. EQC16 attempts to solve this particular problem. It borrows the design from ABV (Aggregated Bit-Vector) algorithm and adds some effective optimizations. EQC16 uses 16 bit lookup to reduce memory accesses, min-max rule information to narrow down search scope, and combines two 8 bit fields for fast search. It has very high classification speed, reasonable memory requirement and small preprocessing time for large rule-sets and it supports real-time incremental updates. EQC16 algorithm was evaluated and compared with existing decomposition based algorithms BV (Bit-Vector), ABV and RFC (Recursive Flow Classification). The results indicate that EQC16 outperforms both BV and ABV in terms of classification speed and RFC in terms of preprocessing time and incremental update feature.