Multi-match Packet Classification Research Articles

Packet Classification Using TCAM of Narrow Entries

Packet classification based on rules of packet header fields is the key technology for enabling software-defined networking (SDN). Ternary content addressable memory (TCAM) is a widely used hardware for packet classification; however, commercially available TCAM chips have only limited storage. As the number of supported header fields in SDN increases, the number of supported rules in a TCAM chip is reduced. In this work, we present a novel scheme to enable packet classification using TCAM with entries that are narrower than rules by storing the most representative field of a ruleset in TCAM. Due to the fact that not all rules can be distinguished using one field, our scheme employs a TCAM-based multimatch packet classification technique to ensure correctness. We further develop approaches to reduce redundant TCAM accesses for multimatch packet classification. Although our scheme requires additional TCAM accesses, it supports packet classification upon long rules with narrow TCAM entries, and drastically reduces the required TCAM storage. Our experimental results show that our scheme requires a moderate number of additional TCAM accesses and consumes much less storage compared to the basic TCAM-based packet classification. Thus, it can provide the required scalability for long rules required by potential applications of SDN.

Hardware-based multi-match packet classification in NIDS: an overview and novel extensions for improving the energy efficiency of TCAM-based classifiers

Hardware-based multi-match packet classification in NIDS: an overview and novel extensions for improving the energy efficiency of TCAM-based classifiers

RETRACTED: Efficient soft error resiliency by multi-match packet classification using scalable TCAM implementation in FPGA

Ternary content addressable memories (TCAMs) are generally utilized for system gadgets to actualize parcel characterization. They are utilized, for instance, for bundle sending, for security, and to actualize programming characterized systems (SDNs). TCAMs are normally executed as independent gadgets or as a protected innovation obstruct that is coordinated on systems administration application-explicit incorporated circuits. Then again, field-programmable entryway exhibits (FPGAs) excluding TCAM squares. Be that as it may, the adaptability of FPGAs impacts in alluring for SDN usage, and majority of field programmable gate array merchants give improvement packs to SDN. By considering implementation of TCAM in FPGA and, hence, there is an importance to imitate TCAMs utilizing the rationale squares possible to be reached in the FPGA. Lately, various plans to imitate TCAMs on FPGAs have been devised. Least among them exploit the major of memory squares accessible into the inner part of present day FPGAs to utilize them to execute TCAMs. An issue when utilizing recollections is that those squares will be influenced by delicate blunders that degenerate the put away bits. The recollections can be secured with an equality test to distinguish blunders or with a mistake redress code to address them, yet it needs extra bits of memory for each word. Regarding the above concise, the insurance of the recollections used to imitate new TCAM has been implemented. Specifically, it is appeared by abusing the way that just a subset of the conceivable memory substance are legitimate, most single-piece blunders can be redressed when the recollections are ensured with an equality bit.

Fast TCAM-Based Multi-Match Packet Classification Using Discriminators

Ternary content addressable memory (TCAM) is a widely used technology for network devices to perform packet classification. TCAM compares a search key with all ternary entries in parallel to yield the first matching entry. To generate all matching entries, either storage or speed penalty is inevitable. Because of the inherit disadvantages of TCAM, including power hungry and limited capacity, the feasibility of TCAM-based multi-match packet classification (TMPC) is thus debatable. Discriminators appended to each TCAM entry have been used to avoid storage penalty for TMPC. We are motivated to minimize speed penalty for TMPC with discriminators. In this paper, a novel scheme, which utilizes unused TCAM entries to accelerate the search performance, is presented. It selectively generates TCAM entries to merge overlapping match conditions so that the number of accessed TCAM entries can be significantly reduced. By limiting the number of generated TCAM entries, the storage penalty is minimized since our scheme does not need extra TCAM chips. We further present several refinements to the search procedure. The experimental results show that our scheme can drastically improve the search performance with extra 10-20 percent TCAM entries. As a result, the power consumption, which correlates to the number of accessed TCAM entries per classification, can be reduced.

Multi-match Packet Classification Scheme Combining TCAM with an Algorithmic Approach

Packet classification is one of the essential functionalities of Internet routers in providing quality of service. Since the arrival rate of input packets can be tens-of-millions per second, wirespeed packet classification has become one of the most challenging tasks. While traditional packet classification only reports a single matching result, new network applications require multiple matching results. Ternary content-addressable memory (TCAM) has been adopted to solve the multi-match classification problem due to its ability to perform fast parallel matching. However, TCAM has a fundamental issue: high power dissipation. Since TCAM is designed for a single match, the applicability of TCAM to multi-match classification is limited. In this paper, we propose a cost- and energy-efficient multi-match classification architecture that combines TCAM with a tuple space search algorithm. The proposed solution uses two small TCAM modules and requires a single-cycle TCAM lookup, two SRAM accesses, and several Bloom filter query cycles for multimatch classifications.

Scalable Multi-Match Packet Classification Using TCAM and SRAM

Packet classification is an enabling technology for various network services. Fast single-match packet classification can be achieved by using ternary content addressable memory (TCAM) because of the superior speed performance. TCAM has some drawbacks including incapability to store arbitrary ranges, confined TCAM capacity and limited choices of entry lengths. Moreover, TCAM only reports the first matching entry to impose a limitation on supporting multi-match packet classification, which requires all matching rules. The existing algorithms deal with the issues of TCAM-based multi-match packet classification by burdening TCAM with extra entries and/or accesses. In this work, we offload the overhead of TCAM to static random access memory (SRAM) to achieve efficient multi-match packet classification. Our scheme synthesizes TCAM compatible entries by using binary decision trees and employs SRAM for further comparisons. Each synthesized entry can be stored in one TCAM entry to significantly reduce TCAM consumption and fulfill low power consumption. The experimental results show that our scheme can lower the demand of TCAM to improve both search latency and energy efficiency. The scalability of TCAM-based multi-match packet classification can thus be improved drastically.

TCAM-Based Multi-Match Packet Classification Using Multidimensional Rule Layering

Ternary content addressable memory (TCAM) has superior performance for single-match packet classification but not the case for multi-match packet classification. The limitation is caused by TCAM architecture that reports only the first matching rule. To cope with the limitation, previous algorithms use extra TCAM entries or accesses, or both, to fulfill multi-match packet classification. These algorithms also reorder rules; thus, a multi-match classifier based on these algorithms cannot maintain performance for single-match packet classification. In other words, all matching rules must be yielded to determine the highest priority matching rule. In this paper, we present a TCAM-based scheme for multi-match packet classification without single-match penalty. Our scheme partitions a rule set based on range layering, which can be applied to achieve range encoding. The rule partitioning generates rule subsets which satisfy that the rules in a subset are mutually disjoint. Each rule is then tagged a bitmap for subset identification to fulfill multi-match packet classification. Two approaches, loose coupling and tight coupling, are derived with different search procedures while incorporating range encoding. Both approaches can maintain original rule order, but with different performance tradeoff. We also present a refinement which uses all available TCAM entries to improve the performance of multi-match packet classification. The experimental results show that combining range encoding with multi-match packet classification has advantages of storage efficiency and speed superiority. The capability of supporting single-match packet classification also provides better flexibility of applying different packet actions.

Hybrid memory-efficient multimatch packet classification for NIDS

Network applications such as network intrusion detection systems (NIDSs) require multimatch packet classification, where all matched results need to be reported. Most researchers have adopted a TCAM-based architecture to enhance system performance, but TCAM consumes high amounts of power and requires a lot of memory resources. In this paper, we analyze the characteristics of the Snort rule set, and propose an memory-efficient multimatch packet classification architecture for NIDS using the result of analysis. The proposed hybrid architecture uses hash-based matching for searching single port numbers and k-ary tree matching for searching range port numbers and is synthesized on Altera Stratix IV FPGA. Compared with previous TCAM-based architectures, our design achieves over four times improvement in memory requirement and power consumption. Our architecture sustains 16.8–67.4Gbps throughput for minimum size (40bytes) packets.

High-Throughput and Memory-Efficient Multimatch Packet Classification Based on Distributed and Pipelined Hash Tables

The emergence of new network applications, such as the network intrusion detection system and packet-level accounting, requires packet classification to report all matched rules instead of only the best matched rule. Although several schemes have been proposed recently to address the multimatch packet classification problem, most of them require either huge memory or expensive ternary content addressable memory (TCAM) to store the intermediate data structure, or they suffer from steep performance degradation under certain types of classifiers. In this paper, we decompose the operation of multimatch packet classification from the complicated multidimensional search to several single-dimensional searches, and present an asynchronous pipeline architecture based on a signature tree structure to combine the intermediate results returned from single-dimensional searches. By spreading edges of the signature tree across multiple hash tables at different stages, the pipeline can achieve a high throughput via the interstage parallel access to hash tables. To exploit further intrastage parallelism, two edge-grouping algorithms are designed to evenly divide the edges associated with each stage into multiple work-conserving hash tables. To avoid collisions involved in hash table lookup, a hybrid perfect hash table construction scheme is proposed. Extensive simulation using realistic classifiers and traffic traces shows that the proposed pipeline architecture outperforms HyperCuts and B2PC schemes in classification speed by at least one order of magnitude, while having a similar storage requirement. Particularly, with different types of classifiers of 4K rules, the proposed pipeline architecture is able to achieve a throughput between 26.8 and 93.1 Gb/s using perfect hash tables.

A space- and power-efficient multi-match packet classification technique combining TCAMs and SRAMs

Packet classification is implemented in modern network routers for providing differentiated services based on packet header information. Traditional packet classification only reports a single matched rule with the highest priority for an incoming packet and takes an action accordingly. With the emergence of new Internet applications such as network intrusion detection system, all matched rules need to be reported. This multi-match problem is more challenging and is attracting attentions in recent years. Because of the stringent time budget on classification, architectural solutions using ternary content addressable memory (TCAM) are the preferred choice for backbone network routers. However, despite its advantage on search speed, TCAM is much more expensive than SRAM, and is notorious for its extraordinarily high power consumption. These problems limit the application and scalability of TCAM-based solutions. This paper presents a tree-based multi-match packet classification technique combining the benefits of both TCAMs and SRAMs. The experiments show that the proposed solution achieves significantly more savings on both memory space and power consumption on packet matching compared to existing solutions.

Wire-Speed TCAM-Based Architectures for Multimatch Packet Classification

Most conventional packet classifiers find only the highest priority filter that matches the arriving packet. However, new networking applications such as network intrusion detection systems and load balancers require all (or the first few) matching packets during classification. In this paper, two TCAM-based architectures for multi-match search are introduced. The first one is a renovated TCAM design that can find all or the first r matches in a packet filter set. The second architecture is a novel partitioning scheme based on filter intersection properties allowing us to use off-the-shelf TCAMs for multi-match packet classification. Our classifier engine finds all matches in exactly one conventional TCAM cycle while reducing the power consumption by at least two orders of magnitude, which is far better than the existing hardware based designs.

Efficient Multimatch Packet Classification for Network Security Applications

New network applications like intrusion detection systems and packet-level accounting require multimatch packet classification, where all matching filters need to be reported. Ternary content addressable memories (TCAMs) have been adopted to solve the multimatch classification problem due to their ability to perform fast parallel matching. However, TCAMs are expensive and consume large amounts of power. None of the previously published multimatch classification schemes are both memory and power efficient. In this paper, we develop a novel scheme that meets both requirements by using a new set splitting algorithm (SSA). The main idea behind SSA is that it splits filters into multiple groups and performs separate TCAM lookups into these groups. It guarantees the removal of at least 1/2 the intersections when a filter set is split into two sets, thus resulting in low TCAM memory usage. SSA also accesses filters in the TCAM only once per packet, leading to low-power consumption. We compare SSA with two best known schemes: multimatch using discriminators (MUD) (Lakshminarayanan and Rangarajan, 2005) and geometric intersection-based solutions (Yu and Katz, 2004). Simulation results based on the SNORT filter sets show that SSA uses approximately the same amount of TCAM memory as MUD, but yields a 75%-95% reduction in power consumption. Compared with geometric intersection-based solutions, SSA uses 90% less TCAM memory and power at the cost of one additional TCAM lookup per packet. We also show that SSA can be combined with SRAM/TCAM hybrid approaches to further reduce energy consumption

Efficient Multimatch Packet Classification and Lookup with TCAM

Today's packet classification systems are designed to provide the highest-priority matching result, such as the longest prefix match, even if a packet matches multiple classification rules. However, new network applications demanding multimatch classification - that is, requiring all matching results instead of only the highest-priority match - are emerging. Ternary content-addressable memory is becoming a common extension to network processors, and its capability and speed make it attractive for high-speed networks. The proposed TCAM-based scheme produces multimatch classification results with about 10 times fewer memory lookups than a pure software approach. In addition, their scheme for removing negation in rule sets saves up to 95 percent of the TCAM space used by a straightforward implementation.