Traffic-aware Access Control List Reconstruction

Abstract

Access Control Lists (ACL) are configured by a net-work administrator in advance and determination of permit/deny of a packet is made based on the rule lists. The rule list is often created manually by the network administrator and the quality of an ACL depends on the skill of the network administrator. There could be redundant rules that can be integrated with other rules. Since the number of packets handled by ACL is enormous, matching process with such useless rules might cause serious performance degradation of the entire ACL. In this paper, we propose a method to reconstruct rule lists from traffic data labeled by ACL.