High-speed Packet Classification Research Articles

TupleTree: A High-Performance Packet Classification Algorithm Supporting Fast Rule-Set Updates

Packet classification plays a crucial role in various network functions such as access control and routing. In recent years, the rapid development of SDN and NFV poses new challenges for packet classification to support fast rule-set updates as introducing strong dynamics for the structure of networks. To this end, this paper proposes a novel scheme, TupleTree, to perform high-speed packet classification while providing fast rule-set update ability. TupleTree is a hybrid scheme combining decision tree and tuple space. In TupleTree, it organizes rules in a decision tree-like structure, but distributes rules in each node into child nodes through hashing rather than cutting or splitting. With the decision tree structure, for each classification, one leaf node containing a few rules can be rapidly indexed. Hence, a high classification performance can be achieved. Meanwhile, with hashing instead of cutting or splitting, it is easy to support fast rule-set updates due to having avoided the rule replication problem. Compared to state-of-the-art schemes that support fast rule-set updates, experimental results show that our proposed scheme achieves a classification performance improvement of 85% to 237% while retaining close update performance for large rule-sets.

PCMIgr: a fast packet classification method based on information gain ratio

To solve the problem of ambiguous attribute selection in existing decision tree classification algorithms, a decision tree construction method based on information entropy, PCMIgr, is proposed. PCMIgr is a heuristic method based on greedy strategy. At each decision tree node, when it is necessary to select classification attributes for division, the attribute with the highest information gain ratio is selected. The main innovation of this method is that the attribute selection in the traditional classification method based on decision tree is optimized, and the classification efficiency of the constructed decision tree is improved compared with that before optimization. At the same time, the decision tree ensures that each leaf node is only associated with one rule, which avoids the common problem of "rule replication" in the process of traditional decision tree construction, and effectively saves memory and calculation time. The experimental results show that the application of this method to the construction of classification decision tree can further improve the efficiency of packet classification method based on decision tree, and can be applied to high-speed real-time packet classification.

KDB: a fast update and high speed packet classifier in SDN

Packet classification is a fundamental function to support several services of software defined networking (SDN). Increasing complexity of the flow tables in SDN leads to challenges for packet classification on update and classification time. In this paper, we propose KDB, a hybrid decision tree classifier, to achieve fast update and high speed packet classification. Experimental results show that KDB is faster in update time compared with SmartSplit and PartitionSort, two state-of-the-art decision tree classifiers, and achieves comparable classification time. Compared with Tuple Search Space (TSS), a classifier used in Open vSwitch, KDB is faster in classification time and achieves comparable update time.

Wildcard Fields-Based Partitioning for Fast and Scalable Packet Classification in Vehicle-to-Everything.

Vehicle-to-Everything (V2X) requires high-speed communication and high-level security. However, as the number of connected devices increases exponentially, communication networks are suffering from huge traffic and various security issues. It is well known that performance and security of network equipment significantly depends on the packet classification algorithm because it is one of the most fundamental packet processing functions. Thus, the algorithm should run fast even with the huge set of packet processing rules. Unfortunately, previous packet classification algorithms have focused on the processing speed only, failing to be scalable with the rule-set size. In this paper, we propose a new packet classification approach balancing classification speed and scalability. It can be applied to most decision tree-based packet classification algorithms such as HyperCuts and EffiCuts. It determines partitioning fields considering the rule duplication explicitly, which makes the algorithm memory-effective. In addition, the proposed approach reduces the decision tree size substantially with the minimal sacrifice of classification performance. As a result, we can attain high-speed packet classification and scalability simultaneously, which is very essential for latest services such as V2X and Internet-of-Things (IoT).

Efficient Memristor-Based Architecture for Intrusion Detection and High-Speed Packet Classification

Deep packet inspection (DPI) is a critical component to prevent intrusion detection. This requires a detailed analysis of each network packet header and body. Although this is often done on dedicated high-power servers in most networked systems, mobile systems could potentially be vulnerable to attack if utilized on an unprotected network. In this case, having DPI hardware on the mobile system would be highly beneficial. Unfortunately, DPI hardware is generally area and power consuming, making its implementation difficult in mobile systems. We developed a memristor crossbar-based approach, inspired by memristor crossbar neuromorphic circuits, for a low-power, low-area, and high-throughput DPI system that examines both the header and body of a packet. Two key types of circuits are presented: static pattern matching and regular expression circuits. This system is able to reduce execution time and power consumption due to its high-density grid and massive parallelism. Independent searches are performed using low-power memristor crossbar arrays giving rise to a throughput of 160Gbps with no loss in the classification accuracy.

A Sorted-Partitioning Approach to Fast and Scalable Dynamic Packet Classification

The advent of software-defined networking (SDN) leads to two key challenges for packet classification on the dramatically increased dynamism and dimensionality. Although packet classification is a well-studied problem, no existing solution satisfies these new requirements without sacrificing classification speed. Decision tree methods, such as HyperCuts, EffiCuts, and SmartSplit can achieve high-speed packet classification, but support neither fast updates nor high dimensionality. The tuple space search (TSS) algorithm used in Open vSwitch achieves fast updates and high dimensionality but not high-speed packet classification. In this paper, we propose a hybrid approach, PartitionSort, that combines the benefits of both TSS and decision trees achieving high-speed packet classification, fast updates, and high dimensionality. A key to PartitionSort is a novel notion of ruleset sortability that provides two key benefits. First, it results in far fewer partitions than the TSS. Second, it allows the use of multi-dimensional interval trees to achieve logarithmic classification and update time for each sortable ruleset partition. Our extensive experimental results show that The PartitionSort is an order of magnitude faster than the TSS in classifying packets while achieving comparable update time. The PartitionSort is a few orders of magnitude faster in construction time than SmartSplit, a state-of-the-art decision tree classifier, while achieving a competitive classification time. Finally, the PartitionSort is scalable to an arbitrary number of fields and requires only linear space.

A Ternary Unification Framework for Optimizing TCAM-Based Packet Classification Systems

Packet classification is the key mechanism for enabling many networking and security services. Ternary content addressable memory (TCAM) has been the industrial standard for implementing high-speed packet classification because of its constant classification time. However, TCAM chips have small capacity, high power consumption, high heat generation, and large area-size. This paper focuses on the TCAM-based classifier compression problem: given a classifier $C$ , we want to construct the smallest possible list of TCAM entries $T$ that implement $C$ . In this paper, we propose the ternary unification framework (TUF) for this compression problem and three concrete compression algorithms within this framework. The framework allows us to find more optimization opportunities and design new TCAM-based classifier compression algorithms. Our experimental results show that the TUF can speed up the prior algorithm TCAM Razor by 20 times or more and leads to new algorithms that improve compression performance over prior algorithms by an average of 13.7% on our largest real-life classifiers. The experimental results show that our algorithms can improve both the runtime and the compression ratio over prior work.

RFC: Range feature code for TCAM-based packet classification

Packet classification has been widely used in various Internet applications, including the recent hot topic SDN. Generally, TCAM is a typical device for high-speed packet classification. However, when it comes to some classification rules that contain ranges, since TCAM is not well designed to represent ranges, range expansion problem is caused. Range expansion could cost much more TCAM entries than the number of rules, thus impairing the utilization of TCAM. In practice, there are some unused bits in a TCAM entry, which could be used to reduce the range expansion. In this paper, we propose a scheme to efficiently represent ranges with such extra bits. Our scheme is based on the observation that in prior encoding schemes that use extra bits to represent ranges, the encoding in extra bits and its fallback scheme are always regarded as two totally separate processes. Even though the two encoding methods are different, as they both focus on the same rule, there actually exists some relevance in information of the two encoding process. In our scheme, the two encoding processes are brought together with range feature code (RFC) as the link, thus reducing the information redundancy between them. Experiment results show that when 36 extra bits are available in TCAM, our scheme reduces the redundancy of range rules by around 36% compared with the best prior scheme.

Packet Classification Using Binary Content Addressable Memory

Packet classification is the core mechanism that enables many networking devices. Although using ternary content addressable memory (TCAM) to perform high-speed packet classification has become the widely adopted solution, TCAM is very expensive, has limited capacity, consumes large amounts of power, and generates tremendous amounts of heat because of their extremely dense and parallel circuitry. In this paper, we propose the first packet classification scheme that uses binary CAM (BCAM). BCAM is similar to TCAM except that in BCAM, every bit has only two possible states: 0 or 1; in contrast, in TCAM, every bit has three possible states: 0, 1, or * (don’t care). Because of the high complexity in implementing the extra “don’t care” state, TCAM has much higher circuit density than BCAM. As the power consumption, heat generation, and price grow non-linearly with circuit density, BCAM consumes much less power, generates much less heat, and costs much less money than TCAM. Our BCAM-based packet classification scheme is built on two key ideas. First, we break a multi-dimensional lookup into a series of 1-D lookups. Second, for each 1-D lookup, we convert the ternary matching problem into a binary string exact matching problem. To speed up the lookup process, we propose a number of optimization techniques, including skip lists, free expansion, minimizing maximum lookup time, minimizing average lookup time, and lookup short circuiting. We evaluated our BCAM scheme on 17 real-life packet classifiers. On these classifiers, our BCAM scheme requires roughly five times fewer CAM bits than the traditional TCAM-based scheme. The penalty is a throughput that is roughly four times less.

A multi-pipeline architecture for high-speed packet classification

In typical algorithmic packet classification methods, the data structure is tailored for the given ruleset. It is common among published algorithmic methods that the worst case number of memory accesses per classification depends on the properties of the ruleset, such as the distribution of the address prefixes and port ranges. As a result, existing methods cannot assure constant classification rate. A novel multi-pipeline architecture for packet classification is presented in this paper. Our method has outstanding performance in both space and time. We incorporate the prefix inclusion coding scheme to achieve outstanding memory efficiency. For rulesets with 10 thousand rules, the storage cost of our method is between 16 and 24.5bytes per rule. The hardware uses fixed-length linear pipelines. Hence, the classification rate is constant regardless of the ruleset properties. To demonstrate the feasibility of our method, the proposed architecture is implemented on a Virtex-6 FPGA and the device can achieve a classification rate of 340million packets per second. Power dissipation of the device is about 1.43W.

A Scalable and Modular Architecture for High-Performance Packet Classification

Packet classification is widely used as a core function for various applications in network infrastructure. With increasing demands in throughput, performing wire-speed packet classification has become challenging. Also the performance of today's packet classification solutions depends on the characteristics of rulesets. In this work, we propose a novel modular Bit-Vector (BV) based architecture to perform high-speed packet classification on Field Programmable Gate Array (FPGA). We introduce an algorithm named StrideBV and modularize the BV architecture to achieve better scalability than traditional BV methods. Further, we incorporate range search in our architecture to eliminate ruleset expansion caused by range-to-prefix conversion. The post place-and-route results of our implementation on a state-of-the-art FPGA show that the proposed architecture is able to operate at 100+ Gbps for minimum size packets while supporting large rulesets up to 28 K rules using only the on-chip memory resources. Our solution is ruleset-feature independent , i.e. the above performance can be guaranteed for any ruleset regardless the composition of the ruleset.

Space and speed tradeoffs in TCAM hierarchical packet classification

Traffic classification in the Internet is a crucial mechanism necessary to support network services. Using Ternary Content-Addressable Memories (TCAMs) to perform high-speed packet classification has become the de facto standard in industry. TCAMs concurrently match the packet headers against the rules in a classification database providing high throughput unparalleled by software-based solutions. The complexity of packet classification policies has been growing rapidly as the number of Internet services continues to increase. Many complex classification policies are naturally represented in a hierarchical fashion, where different layers perform classification based on the administrative domain and the traffic QoS parameters. However, multiple levels of classification hierarchy incur high lookup latency while high TCAM memory requirements of flattened classification policies is a major issue since TCAMs have very limited capacity. In this paper we focus on the fundamental tradeoff between the TCAM space and the number of lookups in the TCAM classification policies. We consider two optimization problems of dual nature: the first problem is to minimize the number of TCAM entries subject to the constraint on the maximum number of levels in the policy hierarchy; the second problem is to minimize the number of levels in the policy hierarchy subject to the constraint on the maximum number of TCAM entries. We propose efficient algorithms for these problems, which do not require any hardware changes. To the best of our knowledge, this is the first work to study these problems. We also show experimental results that support our findings.

Layered interval codes for TCAM-based classification

Ternary content-addressable memories (TCAMs) are increasingly used for high-speed packet classification. TCAMs compare packet headers against all rules in a classification database in parallel and thus provide high throughput.TCAMs are not well-suited, however, for representing rules that contain range fields and previously published algorithms typically represent each such rule by multiple TCAM entries. The resulting range expansion can dramatically reduce TCAM utilization because it introduces a large number of redundant TCAM entries. This redundancy can be mitigated by making use of extra bits, available in each TCAM entry.We present a scheme for constructing efficient representations of range rules, based on the simple observation that sets of disjoint ranges may be encoded much more efficiently than sets of overlapping ranges. Since the ranges in real-world classification databases are, in general, non-disjoint, the algorithms we present split ranges between multiple layers, each of which consists of mutually disjoint ranges. Each layer is then coded and assigned its own set of extra bits.Our layering algorithms are based on approximations for specific variants of interval-graph coloring. We evaluate these algorithms by performing extensive comparative analysis on real-life classification databases. Our analysis establishes that our algorithms reduce the number of redundant TCAM entries caused by range rules by more than 60% as compared with best range-encoding prior work.

Space-Efficient TCAM-Based Classification Using Gray Coding

Ternary content-addressable memories (TCAMs) are increasingly used for high-speed packet classification. TCAMs compare packet headers against all rules in a classification database in parallel and thus provide high throughput unparalleled by software-based solutions. TCAMs are not well-suited, however, for representing rules that contain range fields. Such rules typically have to be represented (or encoded) by multiple TCAM entries. The resulting range expansion can dramatically reduce TCAM utilization. A TCAM range-encoding algorithm A is database-independent if, for all ranges r, it encodes r independently of the database in which it appears; otherwise, we say that A is database-dependent. Typically, when storing a classification database in TCAM, a few dozens of so-called extra bits in each TCAM entry remain unused. These extra bits are used by some (both database-dependent and database-independent) prior algorithms to reduce range expansion. The majority of real-life database ranges are short. We present a novel database-independent algorithm called Short Range Gray Encoding (SRGE) for the efficient representation of short range rules. SRGE encodes range endpoints as binary-reflected Gray codes and then represents the resulting range by a minimal set of ternary strings. To the best of our knowledge, SRGE is the first algorithm that achieves a reduction in range expansion in general, and a significant expansion reduction for short ranges in particular, without resorting to the use of extra bits. The “traditional” database-independent technique for representing range entries in TCAM is prefix expansion. As we show, SRGE significantly reduces the expansion of short ranges in comparison with prefix expansion. We also prove that the SRGE algorithm's range expansion is at least as good as that of prefix expansion for any range. Real-world classification databases contain a small number of unique long ranges, some of which appear in numerous rules. These long ranges cause high expansion which is not significantly reduced by any database-independent range encoding scheme that we are aware of, including SRGE. We introduce hybrid SRGE, a database-dependent encoding scheme that uses SRGE for reducing the expansion of short ranges and uses extra bits for reducing the expansion caused by long ones. Our comparative analysis establishes that hybrid SRGE utilizes TCAM more efficiently than previously published range-encoding algorithms. This work also makes a more theoretic contribution. Prefix expansion for ranges defined by W-bit endpoints has worst-case expansion ratio of 2W-2. It follows from the work of Schieber et al. [1] that the SRGE algorithm has a slightly better worst-case expansion ratio of 2W-4. We prove that any independent TCAM encoding scheme has worst-case expansion ratio of at least W.

패킷 분류를 위한 스마트 셋-프루닝 트라이

Packet classification is one of the basic and important functions of the Internet routers, and it became more important along with new emerging application programs requiring real-time transmission. Since packet classification should be accomplished in line-speed on each incoming input packet for multiple header fields, it becomes one of the challenges in designing Internet routers. Various packet classification algorithms have been proposed to provide the high-speed packet classification. Hierarchical approach achieves effective packet classification performance by significantly narrowing down the search space whenever a field lookup is completed. However, hierarchical approach involves back-tracking problem. In order to solve the problem, set-pruning trie and grid-of-trie algorithms are proposed. However, the algorithm either causes excessive node duplication or heavy pre-computation. In this paper, we propose a smart set-pruning trie which reduces the number of node duplication in the set-pruning trie by the simple merging of the lower-level tries. Simulation result shows that the proposed trie has the reduced number of copied nodes by 2-8% compared with the set-pruning trie.

PEDS: A Parallel Error Detection Scheme for TCAM Devices

Ternary content-addressable memory (TCAM) devices are increasingly used for performing high-speed packet classification. A TCAM consists of an associative memory that compares a search key in parallel against all entries. TCAMs may suffer from error events that cause ternary cells to change their value to any symbol in the ternary alphabet {0,1,*}. Due to their parallel access feature, standard error detection schemes are not directly applicable to TCAMs; an additional difficulty is posed by the special semantic of the * symbol. This paper introduces PEDS, a novel parallel error detection scheme that locates the erroneous entries in a TCAM device. PEDS is based on applying an error-detecting code to each TCAM entry and utilizing the parallel capabilities of the TCAM by simultaneously checking the correctness of multiple TCAM entries. A key feature of PEDS is that the number of TCAM lookup operations required to locate all errors depends on the number of symbols per entry in a manner that is typically orders of magnitude smaller than the number of TCAM entries. For large TCAM devices, a specific instance of PEDS requires only 200 lookups for 100-symbol entries, while a naive approach may need hundreds of thousands of lookups. PEDS allows flexible and dynamic selection of tradeoff points between robustness, space complexity, and number of lookups.

Active Network Based Queue Management for Providing QoS Using IXP 2400 Network Processor

The objective of this paper is to implement the Active Network based Active Queue Management Technique for providing Quality of Service (QoS) using Network Processor (NP) based router to enhance multimedia applications. The performance is evaluated using Intel IXP2400 NP Simulator. The results demonstrate that, Active Network based Active Queue Management has better performance than RED algorithm and is well suited to achieve high speed packet classification to support multimedia applications with minimum delay and Queue loss. Using simulation, we show that the proposed system can provide assurance for prioritized flows with improved network utilization where bandwidth is shared among the flows according to the levels of priority. We first analyze the feasibility and optimality of the load distribution schemes and then present separate solutions for non-delaysensitive streams and delay-sensitive streams. Rigorous simulations and experiments have been carried out to evaluate the performance.

A fast IPv6 packet classification algorithm based on efficient multi-bit selection

Decision tree based schemes are widely used in designing high-speed packet classification algorithms. The primary objective is to construct a decision tree with minimal storage and searching time complexity. In this paper, we proposed a novel decision tree packet classification algorithm based on Efficient Multiple Bit Selection (EMBS). In the proposed algorithm, prefix fields are transformed to a set of independent bits; and multiple arbitrary bits are selected to cut nodes when building the decision tree. A Performance Estimate Function (PEF) and an efficient bit selecting algorithm are exploited to determine which bits should be selected to obtain an efficient decision tree with high performance. The proposed EMBS algorithm is capable of handling range match fields, and it is suitable for IPv6 packet classification as well as IPv4. Evaluation results show that EMBS provides a great improvement over recent decision tree based algorithms in both space requirement and searching performance.

Complete Redundancy Removal for Packet Classifiers in TCAMs

Packet classification is the core mechanism that enables many networking services on the Internet such as firewall packet filtering and traffic accounting. Using ternary content addressable memories (TCAMs) to perform high-speed packet classification has become the de facto standard in the industry. TCAMs classify packets in constant time by comparing a packet with all classification rules of ternary encoding in parallel. Despite their high speed, TCAMs suffer from the well-known interval expansion problem. As packet classification rules usually have fields specified as intervals, converting such rules to TCAM-compatible rules may result in an explosive increase in the number of rules. This is not a problem if TCAMs have large capacities. Unfortunately, TCAMs have very limited capacity, and more rules means more power consumption and more heat generation for TCAMs. Even worse, the number of rules in packet classifiers have been increasing rapidly with the growing number of services deployed on the Internet. In this paper, we propose to address the interval expansion problem of TCAMs by removing redundant rules in classifiers. This equivalent transformation can significantly reduce the number of TCAM entries needed by a classifier. Our experiments on real-life classifiers show an average reduction of 58.2 percent in the number of TCAM entries by removing redundant rules. Given the logical interleaving nature of packet filtering rules, identifying redundant rules in classifiers is by no means trivial, and to achieve the guarantee of no redundant rules in resulting classifiers is even more challenging. In this paper, for the first time, we give a necessary and sufficient condition for identifying all redundant rules in a classifier. Based on this condition, we categorize redundant rules into upward redundant rules and downward redundant rules. Second, we present two algorithms for detecting and removing the two types of redundant rules, respectively. Third, we formally prove that the resulting classifiers have no redundant rules after running the two algorithms. Last, we conduct extensive experiments on both real-life and synthetic classifiers. The experimental results show that our redundancy removal algorithms are both effective and efficient.

TCAM Razor: A Systematic Approach Towards Minimizing Packet Classifiers in TCAMs

Packet classification is the core mechanism that enables many networking services on the Internet such as firewall packet filtering and traffic accounting. Using ternary content addressable memories (TCAMs) to perform high-speed packet classification has become the de facto standard in industry. TCAMs classify packets in constant time by comparing a packet with all classification rules of ternary encoding in parallel. Despite their high speed, TCAMs suffer from the well-known range expansion problem. As packet classification rules usually have fields specified as ranges, converting such rules to TCAM-compatible rules may result in an explosive increase in the number of rules. This is not a problem if TCAMs have large capacities. Unfortunately, TCAMs have very limited capacity, and more rules mean more power consumption and more heat generation for TCAMs. Even worse, the number of rules in packet classifiers has been increasing rapidly with the growing number of services deployed on the Internet. In this paper, we consider the following problem: given a packet classifier, how can we generate another semantically equivalent packet classifier that requires the least number of TCAM entries? In this paper, we propose a systematic approach, the TCAM Razor, that is effective, efficient, and practical. In terms of effectiveness, TCAM Razor achieves a total compression ratio of 29.0%, which is significantly better than the previously published best result of 54%. In terms of efficiency, our TCAM Razor prototype runs in seconds, even for large packet classifiers. Finally, in terms of practicality, our TCAM Razor approach can be easily deployed as it does not require any modification to existing packet classification systems, unlike many previous range encoding schemes.