Forwarding Table Research Articles

Flow-aware Segment Routing in SDN-enabled Data Center Networks

The underlying objective of segment routing is to avoid maintenance of the per-flow state at forwarding devices. Segment routing (SR) enables the network devices to minimize their forwarding table size by generalizing the forwarding rules and making them applicable to multiple flows. In existing works, optimizing the trade-off between segment length and the number of co-flows sharing the segment is considered the key to determining optimal segment endpoints. However, the flow characteristics like the lifetime of flows, and dynamically altering routing paths are critical and impact the performance of SR. Ideally, network flows considered for SR are expected to persist for a longer duration and adhere to static routing paths. But our analysis of flow characteristics at a typical data center reveals that the majority of flows are short-lived. Also, network flows are subject to alter their routing paths frequently for several reasons. Considering short-lived flows and flows that dynamically alter their routing paths may lead to choosing unstable segment endpoints. Hence, it is necessary to study the flow characteristics for determining more stable segment endpoints. In this paper, the authors implemented the SR technique considering the flow characteristics at an SDN-enabled data center and the results show a significant improvement with respect to the stability of segment endpoints.

Duo: A High-Throughput Reconfigurable Datacenter Network Using Local Routing and Control

The performance of many cloud-based applications critically depends on the capacity of the underlying datacenter network. A particularly innovative approach to improve the throughput in datacenters is enabled by emerging optical technologies, which allow to dynamically adjust the physical network topology, both in an oblivious or demand-aware manner. However, such topology engineering, i.e., the operation and control of dynamic datacenter networks, is considered complex and currently comes with restrictions and overheads. We present Duo, a novel demand-aware reconfigurable rack-to-rack datacenter network design realized with a simple and efficient control plane. Duo is based on the well-known de Bruijn topology (implemented using a small number of optical circuit switches) and the key observation that this topology can be enhanced using dynamic (''opportunistic'') links between its nodes. In contrast to previous systems, Duo has several desired features: i) It makes effective use of the network capacity by supporting integrated and multi-hop routing (paths that combine both static and dynamic links). ii) It uses a work-conserving queue scheduling which enables out-of-the-box TCP support. iii) Duo employs greedy routing that is implemented using standard IP longest prefix match with small forwarding tables. And iv) during topological reconfigurations, routing tables require only local updates, making this approach ideal for dynamic networks. We evaluate Duo in end-to-end packet-level simulations, comparing it to the state-of-the-art static and dynamic networks designs. We show that Duo provides higher throughput, shorter paths, lower flow completion times for high priority flows, and minimal packet reordering, all using existing network and transport layer protocols. We also report on a proof-of-concept implementation of Duo's control and data plane.

Оценка влияния протокола Openflow на производительность сетевых устройств

A very promising area of computer network technologies is the use of Software Defined Network (SDN). The principles of SDN first emerged in the Stanford and Berkeley research laboratories and are currently being developed as part of the Open Network Foundation consortium and the European project OFELIA. The openness of the OpenFlow standard and the introduction of control logic into a separate controller simplifies the software and hardware of active network equipment, which will allow manufacturers to reduce its cost in the future, and therefore reduce the cost of creating computer networks. Therefore, research in this area is very promising. This work is devoted to the study of the performance of SDN, namely, how the implementation of the OpenFlow protocol affects the quality of data transfer between network devices. Using a single stream, the maximum throughput is estimated. To do this, three experimental installations of a network with different network devices, a switch, a router and an OpenFlow device, as well as a dedicated Linux server with support for the OpenFlow protocol, are assembled. The essence of the experiments is to change the size of packets and the size of the forwarding table to assess the performance of SDN with different network devices. The results of the analysis showed that the implementation of OpenFlow on Linux systems is able to offer very good performance. OpenFlow shows good performance with a large number of threads.

Low-Latency Service Chaining With Predefined NSH-Based Multipath Across Multiple Datacenters

Service Function Chaining (SFC) provides a method of forwarding traffic flows through one or more service functions (SFs). For service providers, chaining SFs across multiple datacenters to deliver end-to-end services not only provides better utilization of computing resources of datacenters, but also achieves scalability and fault tolerance. However, most telecommunication applications are sensitive to latency, which tends to degrade due to both virtualization and the long distances among datacenters. In this paper, we extend the network service header (NSH) protocol and propose a multipath chaining with the partially-ordered NSH (MCPON) mechanism to achieve low-latency, partially-ordered service function chaining. MCPON adopts a proactive multipath installation for commonly-used service function paths (SFP, a sequence of requisite SFs) to eliminate reactive path decision delays and to reduce end-to-end service latency. To increase multipath diversity for better load balancing, we modify the original NSH encapsulation design so that the multiple paths selected for an SFP are not limited to having the same execution orders of some non-order-constrained SFs. MCPON also utilizes an entry-saving forwarding table design which enables forwarding entries to be shared among different SFC requests. Our evaluations show that proactive k-path computation for an SFC of length l at a scale of n SFFs saves time complexity of <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">${\mathrm{ O}}(kl^{3}n^{3})$ </tex-math></inline-formula> , and multipath service chaining reduces latency by 33–68% compared to single-path service chaining in our simulation scenarios.

Construction and Implementation of Wireless Network Online Learning System Based on Edge Computing

The traditional wireless network laboratory constructed with physical equipment prompts two obvious problems: high hardware investment and long experiment deployment time. To address these issues, this study proposed a novel Wireless Network Physical Teaching System (WNPTS) based on Edge Computing (EC). Firstly, the isolation design of in-band and out-band network avoids the interference between management data and experimental data. Secondly, this study designed a unified experimental resource description method based on XML format, which is parsed and executed by parser and topology switcher to realize the rapid deployment of the experimental environment. In the edge computing layer, multiple Virtual Network Devices (VNDs) were implemented on one physical network device through the following mechanisms: in the process space, each virtual device used an independent working directory and files to build an application software cluster dedicated to each VND. In physical space, this study designed a novel fast-forwarding mechanism, which takes each switch engine chip as one allocation unit and maps the forwarding table in the kernel space to realize the fast data forwarding for each VND. Statistical analysis shows that, compared with traditional approach, WNPTS reduced the total fixed investment cost by 30.25%, shortened the Average Deployment Time of Experimental Environment (ADTEE) from 18.3 minutes to 2.75 minutes, and improved the Timely Completion Rate of Experiments (TCRE) from 59% to 70%.

Entropy-KL-ML:Enhancing the Entropy-KL-Based Anomaly Detection on Software-Defined Networks

The Software-Defined Networking (SDN) concept allows network innovations by leveraging a centralized controller that commands the whole network. The controller manages the functionality of the entire network. In the event that the controller fails, the switches will attempt to continue to forward traffic based on the last set of entries in the forwarding table. Therefore, assuming an unstable network, no interruption can be expected. Consequently, when a controller fails due to an expiration time or capacity limitation for a forwarding table, the controller will not be able to handle newly arriving packets. This will result in the entire network going down. Because of vulnerabilities between the control plane and the data plane, Denial of Service (DoS) attacks often pose the greatest risk to SDN. The paper discusses a method to detect this attack before it leads to failure of the controller. The proposed combined anomaly detection method, which is called Entropy-KL-ML, uses entropy along with KL-divergence and ensemble learning to detect any uncertainty in incoming packets within time slots. KL-divergence and ML classifiers make the detection more accurate. We also present a new method for selecting features based on grouping the features that reduces the computational overhead of the controller. With an anomaly detection method in SDN, it is essential to provide a balance between overhead, accuracy, and processing time. Through a real-world data set and some anomaly detectors, we demonstrate that the Entropy-KL-ML method detects anomalies with greater accuracy and fewer overheads.

ACM: Accuracy-Aware Collaborative Monitoring for Software-Defined Network-Wide Measurement.

Software-defined measurement (SDM) is a simple and efficient way to deploy measurement tasks and collect measurement data. With SDM, it is convenient for operators to implement fine-grained network-wide measurements at the flow level, from which many important functions can benefit. The prior work provides mechanisms to distribute flows to monitors, such that each monitor can identify its non-overlapped subset of flows to measure, and a certain global performance criterion is optimized, such as load balance or flow coverage. Many applications of network management can benefit from a function that can find large flows efficiently, such as congestion control by dynamically scheduling large flows, caching of forwarding table entries, and network capacity planning. However, the current network-wide measurements neglect the diversity of different flows as they treat large flows and small flows equally. In this paper, we present a mechanism of accuracy-aware collaborative monitoring (ACM) to improve the measurement accuracies of large flows in network-wide measurements at the flow level. The structure of the sketch is an approximate counting algorithm, and a high-measurement accuracy can be achieved by merging the results from multiple monitors with sketches, which is termed as collaborative monitoring. The core idea of our method is to allocate more monitors to large flows and achieve the load balance to provide accuracy-aware monitoring. We modeled our problem as an integer–linear programming problem, which is NP-hard. Thus, we propose an approximation algorithm, named the improved longest processing time algorithm (iLPTA); we proved that its approximation ratio is . We propose a two-stage online distribution algorithm (TODA). Moreover, we proved that its approximation ratio is . The iLPTA is an offline approximation algorithm used to assign monitors for each flow, which prove the validity and feasibility of the core idea. The TODA is an online algorithm that attempts to achieve the load balance by selecting the monitor with the smallest load to a large flow. Our extensional experiment results verify the effectiveness of our proposed algorithms.

Scalable routing in low-Earth orbit satellite constellations: Architecture and algorithms

Low-Earth orbit satellite constellations (LEO-SCs) are attractive for provisioning global, high-speed and low latency Internet access services. Due to the fast movement of satellites and the lack of inter-satellite links (ISLs), the LEO-SC topology is highly dynamic. Applying shortest path routing directly to LEO-SCs may suffer from poor scalability and frequent route changes. In this paper, a scalable two-layer routing architecture is first proposed. Based on it, two stable routing algorithms, delay-bounded routing (DBR) and delay-aware routing (DAR), are designed to minimize route changes. DBR is flow-based. It provides bounded network latency but at the cost of a larger forwarding table. DAR is destination-based. Although network latency is not bounded, we show that the further reduction in route changes is significant and the increase in average latency is minimal.

Scalable name identifier lookup for Industrial Internet

Name identifiers are considered more effective than IP addresses in routing and forwarding billions of heterogeneous resource-restrained Industrial Internet objects. Although the design of name-based longest prefix matching lookup has been developed for nearly a decade, it is still attractive to design an efficient name lookup scheme for the Industrial Internet due to hierarchical variable-length names, large-scale forwarding tables, and frequent updates. In this paper, we present a memory-optimized binary search (MOBS) algorithm in the counting Bloom filter (CBF), which decreases memory consumption by reducing the storage of prefix marker entries while maintaining the fast lookup efficiency of binary search. Furthermore, we propose CBF-HT, an efficient and scalable name lookup method that combines counting Bloom filter and hash table to facilitate content forwarding. CBF-HT consists of two stages. Firstly, the longest prefix matching results are obtained through binary search in the counting Bloom filter with MOBS, and then the final lookup results are acquired by linear backtracking in the hash table. CBF-HT can achieve high-speed lookups and fast updates, and significantly reduces memory consumption caused by marker entries through MOBS. We have implemented and evaluated CBF-HT with 10 billion name identifiers. Experimental results show that, compared with the existing binary search on hash table algorithm (BS-HT), CBF-HT increases the forwarding throughput by 45%, eliminates 73% and 90% of memory consumption, and improves the update performance by 48.1%, at the cost of a 7.8% increase in the average number of memory accesses.

COIN: An Efficient Indexing Mechanism for Unstructured Data Sharing Systems

Edge computing promises a dramatic reduction in the network latency and the traffic volume, where many edge servers are placed at the edge of the Internet. Furthermore, those edge servers cache data to provide services for edge users. The data sharing among those edge servers can effectively shorten the latency to retrieve the data and further reduce the network bandwidth consumption. The key challenge is to construct an efficient data indexing mechanism no matter how the data is cached in the edge network. Although this is essential, it is still an open problem. Moreover, existing methods such as the centralized indexing and the DHT indexing in other fields fail to meet the performance demand of edge computing. This paper presents a COordinate-based INdexing (COIN) mechanism for the data sharing in edge computing. COIN maintains a virtual space where switches and data indexes are associated with their coordinates. Then, COIN distributes data indexes to indexing edge servers based on those coordinates. The COIN is effective because any query request from an edge server can be responded when the data has been stored in the edge network. More importantly, COIN is efficient in both routing path lengths and forwarding table sizes for publishing/querying data indexes. We implement COIN in a P4 prototype. Experimental results show that COIN uses 59% shorter path length and 30% less forwarding table entries to retrieve data indexes compared to using Chord, a well-known DHT solution.

A global review of routing mechanisms in the named data network

Named Data Networking (NDN) is the future architecture for the internet, as it should have a good design routing to handle massive node connections with different behaviors. Routing is an important part of NDN since it configures the topology as well as policies, and manages long-term changes to the forwarding table. However, routing protocols are burdened with many challenges that reduce the connection performance. This paper investigates and critically evaluates the classification of NDN routing plane researches. Also, this paper classifies all types of routing protocols that exist in the literature. To our best knowledge, this is the first review that identifies the major challenges, such as routing overhead, in all NDN routing protocol types. This review will serve as guidelines for our future work in NDN routing research.

A Gated Recurrent Unit Deep Learning Model to Detect and Mitigate Distributed Denial of Service and Portscan Attacks

Nowadays, it is common for applications to require servers to run constantly and aim as close as possible to zero downtime. The slightest failure might cause significant financial losses and sometimes even lives. For this reason, security and management measures against network threats are fundamental and have been researched for years. Software-defined networks (SDN) are an advancement in network management due to their centralization of the control plane, as it facilitates equipment setup and administration over the local network. However, this centralization makes the controller a target to denial of service attacks (DoS). In this study, we aim to develop a network anomaly detection and mitigation system that uses gated recurrent unit (GRU) neural networks combined with fuzzy logic. The neural network is trained to forecast future traffic, and anomalies are detected when the forecasting fails. The system is designed to operate in software-defined networks since they provide network flow information and tools to manage forwarding tables. We also demonstrate how the neural network&#x2019;s hyperparameters affect the detection module. The system was tested using two datasets: one with emulated traffic generated by the data communication and networking research group called Orion, from computer science department at state university of Londrina, and CICDDoS2019, a well-known dataset by the anomaly detection community. The results show that GRU networks combined with fuzzy logic are a viable option to detect anomalies in SDN and possibly in other anomaly detection applications. We compared our model with other deep learning techniques.

HDLIDP: A Hybrid Deep Learning Intrusion Detection and Prevention Framework

Distributed denial-of-service (DDoS) attacks are designed to interrupt network services such as email servers and webpages in traditional computer networks. Furthermore, the enormous number of connected devices makes it difficult to operate such a network effectively. Software defined networks (SDN) are networks that are managed through a centralized control system, according to researchers. This controller is the brain of any SDN, composing the forwarding table of all data plane network switches. Despite the advantages of SDN controllers, DDoS attacks are easier to perpetrate than on traditional networks. Because the controller is a single point of failure, if it fails, the entire network will fail. This paper offers a Hybrid Deep Learning Intrusion Detection and Prevention (HDLIDP) framework, which blends signature-based and deep learning neural networks to detect and prevent intrusions. This framework improves detection accuracy while addressing all of the aforementioned problems. To validate the framework, experiments are done on both traditional and SDN datasets; the findings demonstrate a significant improvement in classification accuracy.

On the Prefix Granularity Problem in NDN Adaptive Forwarding

One unique architectural benefit of Named Data Networking (NDN) is adaptive forwarding, i.e., the forwarding plane is able to observe past data retrieval performance and use it to adjust forwarding decisions for future Interests. To be effective, adaptive forwarding assumes that <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Interest Routing Locality</i> is related to Interests’ common name prefix, meaning that Interests sharing the same prefix are likely to follow a similar forwarding path within a short period of time. Since Interests can have multiple common prefixes with different lengths, the real challenge is determining which prefix length should be used in adaptive forwarding to record path performance measurements - we refer to this as the <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Prefix Granularity Problem</i> . The longer the common prefix is, the better the Interest Routing Locality, and the larger the forwarding table. Given the limited FIB size, route names are designed to be considerably shorter than Interest names. Existing adaptive forwarding designs use route names to record path performance measurements, which looses forwarding adaptability as it promises in the event of partial network failures. In this work, we propose to dynamically aggregate and de-aggregate name prefixes in the forwarding table in order to use the prefixes that are the most appropriate given current network situation. In addition, to reduce the overhead of adaptive forwarding, we propose mechanisms to minimize the use of the longest prefix matching in Data packet processing. Simulations demonstrate that the proposed techniques can result in better forwarding decisions in the event of partial network failures with significantly reduced overhead.

Scalable and Reliable Data Center Networks by Combining Source Routing and Automatic Labelling

Today, most user services are based on cloud computing, which leverages data center networks (DCNs) to efficiently route its communications. These networks process high volumes of traffic and require exhaustive failure management. Furthermore, expanding these networks is usually costly due to their constraint designs. In this article, we present enhanced Torii (eTorii), an automatic, scalable, reliable and flexible multipath routing protocol that aims to accomplish the demanding requirements of DCNs. We prove that eTorii is, by definition, applicable to a wide range of DCNs or any other type of hierarchical network and able to route with minimum forwarding table size and capable of rerouting around failed links on-the-fly with almost zero cost. A proof of concept of the eTorii protocol has been implemented using the Ryu SDN controller and the Mininet framework. Its evaluation shows that eTorii balances the load and preserves high-bandwidth utilization. Thus, it optimizes the use of DCN resources in comparison to other approaches, such as Equal-Cost Multi-Path (ECMP).

DeSI: A Decentralized Software-Defined Network Architecture for Internet Exchange Points

Applications of Software-Defined Networking (SDN) to the Internet Routing hold great promises for supporting the ever-growing performance requirements of Internet applications. The inherent centralization of these SDN approaches on the Internet routing comes with the following concerns: 1) <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">privacy</i> , the operators are reluctant to share private routing information, 2) <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">separation of responsibilities</i> , the Internet eXchange Point (IXP) running the centralized controller is involved in the routing and forwarding at too many levels, and 3) <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">scalability</i> , the growing number of IP prefixes routed on the Internet (i.e., hundreds of thousands) pose extremely high requirements at both the control- and data-planes, e.g., several minutes for policy compilations and a large number of forwarding rules, in SDN. In this paper, we propose <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">DeSI</small> to apply SDN at IXPs by considering the above concerns. We break this centralization by devising an SDN-enabled IXP architecture in which each member connects to an SDN-enabled IXP through its SDN controller and SDN switches, thus tackling privacy, scalability, and separation of concerns issues. To spur adoption, we introduce an expressive, yet simple, language to configure the routing policies of the members. Our evaluation shows that <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">DeSI</small> needs <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">n</i> times fewer forwarding table entries for an IXP in which <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">n</i> is the number of IXP members. <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">DeSI</small> also gives the possibility of slowly migrating to the SDN-enabled IXPs.

Fast ReRoute on Programmable Switches

Highly dependable communication networks usually rely on some kind of Fast Re-Route (FRR) mechanism which allows to quickly re-route traffic upon failures, entirely in the data plane. This paper studies the design of FRR mechanisms for emerging reconfigurable switches. Our main contribution is an FRR primitive for programmable data planes, PURR, which provides low failover latency and high switch throughput, by avoiding packet recirculation. PURR tolerates multiple concurrent failures and comes with minimal memory requirements, ensuring compact forwarding tables, by unveiling an intriguing connection to classic “string theory” (i.e., stringology), and in particular, the shortest common supersequence problem. PURR is well-suited for high-speed match-action forwarding architectures (e.g., PISA) and supports the implementation of a broad variety of FRR mechanisms. Our simulations and prototype implementation (on an FPGA and a Tofino switch) show that PURR improves TCAM memory occupancy by a factor of 1.5 ×- 10.8 × compared to a naïve encoding when implementing state-of-the-art FRR mechanisms. PURR also improves the latency and throughput of datacenter traffic up to a factor of 2.8 ×- 5.5 × and 1.2 ×- 2 ×, respectively, compared to approaches based on recirculating packets.

Grouping Service Chains of Multiple Flows in NFV-Based Networks

In Software Defined Networks (SDNs), flows usually request to be processed by a service chain (an ordered set of virtualized network services). SDN-enabled networks manage the routing and processing of flows by a large number of associated finer-granularity rules. These rules are maintained by switches in their local hardware such as Ternary Content Addressable Memories (TCAMs), which support high-speed parallel lookup on wildcard patterns. However, the capacity of hardware switches is limited to thousands because of their high requirements for cost and power. In order to avoid much slower matching by using software switches or even packet loss, we can group flows so that all matching rules can be placed in hardware switches. In such a grouping, all flows in each group match only one rule and will be forwarded to the same routing path, instead of each flow matching one rule. This will result in a longer delay because of processing by the longer newly-grouped service chain. In this paper, we efficiently group flows to minimize the total cost while satisfying the capacity constraint of the forwarding tables in hardware switches. We first prove the submodularity of our objective function and propose a corresponding performance-guaranteed solution. Additionally, we design an efficient heuristic solution based on the classic k-means algorithm. Furthermore, we include discussions on dynamic network situations (insertion, deletion, and update of flows) and an alternative objective. We also conduct real experiments on our testbed to indicate the practicality of our motivation. Extensive simulations are conducted to evaluate the performance of our proposed algorithms.

Optimal segments for forwarding table size minimization in segment‐routed SDNs

SummarySegment routing (SR) is a source routing paradigm where packet forwarding is based on a sequence of instructions known as segments identified using segment IDs (SIDs). An ordered list of SIDs identifies the source route and is carried in the packet headers. Switches in such networks use the SIDs to look up their forwarding tables and forward packets along the segments. Since various flows can share the segments, SR is a mechanism to avoid per‐flow state thereby minimizing the forwarding table size (FTS) of the switches. Software‐defined networks (SDNs) are suitable for SR since the source routing can be accomplished by a centralized controller. Typically, the segment list is limited to a maximum segment list depth (SLD). It can be shown that FTS varies inversely as the SLD. This paper studies the problem of minimizing the FTS given the set of flows and the SLD limitation, which is shown to be NP‐complete. An ILP formulation of the problem is used to solve the problem in relatively small networks. Two different heuristic solutions, BFH and CCH, are presented to solve this problem in large‐scale networks with up to 30,000 nodes and 250,000 flows and for three different network topologies (ring‐of‐rings, fat‐tree, and mesh). The heuristics are shown to perform up to 50% better than an existing FTS minimization technique. Further, CCH is shown to perform better in networks with a high prevalence of equal cost multipaths (ECMPs), while BFH performs better when ECMPs are few in number.

An efficient pipeline processing scheme for programming Protocol-independent Packet Processors

OpenFlow is unable to provide customized flow tables, resulting in memory explosions and high switch retirement rates. This is the bottleneck for the development of SDN. Recently, P4 (Programming Protocol-independent Packet Processors) attracts much attentions from both academia and industry. It provides customized networking services by offering flow-level control. P4 can “produce” various forwarding tables according to packets. P4 increases the speed of custom ASICs. However, with the prevalence of P4, the multiple forwarding tables could explode when used in large scale networks. The explosion problem can slow down the lookup speed, which causes congestions and packet losses. In addition, the pipelined structure of forwarding tables brings additional processing delay. In this study, we will improve the lookup performance by optimizing the forwarding tables of P4. Intuitively, we will install the rules according to their popularity, i.e., the popular rules will appear earlier than others. Thus, the packets can hit the matched rule sooner. In this paper, we formalize the optimization problem, and prove that the problem is NP-hard. To solve the problem, we propose a heuristic algorithm called EPSP (Efficient Pipeline Processing Scheme for P4), which can largely reduce the lookup time while keeping the forwarding actions the same. Because running the optimization algorithm frequently brings additional processing burdens, wedesign an incremental update algorithm to alleviate this problem. To evaluate the proposed algorithms, we set up the simulation environments based on ns-3. The simulation results show that the algorithm greatly reduces both the lookup time and the number of memory accesses. The incremental algorithm largely reduces the processing burdens while the lookup time remains almost the same with the non-incremental algorithm. We also implemented a prototype using floodlight and mininet. The results show that our algorithm brings acceptable burder, and performs better than traditional algorithm.