Packet Classification Algorithm Research Articles

MultiSplit: An Efficient Algorithm for Packet Classification with Equivalent Priority

Packet classification is a core function of network devices for providing advanced services, with the key challenge being to optimize classification speed while maintaining low memory usage. So far, many have proposed software-based packet classification solutions, with most of them adopting a multi-classifier architectures to accommodate the distribution of rule sets. Unfortunately, the need to perform lookups on each classifier during the packet classification stage significantly increases overhead, severely limiting classification speed. To address this shortfall, an efficient packet classification framework based on decision tree algorithms named MultiSplit is proposed. By leveraging the relationships of coverage and priority within the rule set, a new attribute can be abstracted for each rule, termed equivalent priority. Through this preprocessing, MultiSplit significantly reduces redundant lookup overhead while supporting the multi-classifier framework. Additionally, MultiSplit introduces a novel decision tree algorithm that combines multiple splits and intra-level binary search, significantly improving rule separation efficiency. The experimental results show that MultiSplit reduces memory consumption by 49% and decreases memory access by 63%, on average, compared with state-of-the-art packet classification algorithms.

TupleTree: A High-Performance Packet Classification Algorithm Supporting Fast Rule-Set Updates

Packet classification plays a crucial role in various network functions such as access control and routing. In recent years, the rapid development of SDN and NFV poses new challenges for packet classification to support fast rule-set updates as introducing strong dynamics for the structure of networks. To this end, this paper proposes a novel scheme, TupleTree, to perform high-speed packet classification while providing fast rule-set update ability. TupleTree is a hybrid scheme combining decision tree and tuple space. In TupleTree, it organizes rules in a decision tree-like structure, but distributes rules in each node into child nodes through hashing rather than cutting or splitting. With the decision tree structure, for each classification, one leaf node containing a few rules can be rapidly indexed. Hence, a high classification performance can be achieved. Meanwhile, with hashing instead of cutting or splitting, it is easy to support fast rule-set updates due to having avoided the rule replication problem. Compared to state-of-the-art schemes that support fast rule-set updates, experimental results show that our proposed scheme achieves a classification performance improvement of 85% to 237% while retaining close update performance for large rule-sets.

A parallel decision-making design for highly speedy packet classification

Packet classification is crucial in computer networks to increase network security because of developments in high-speed data communication. To support different network services including Quality of Service (QoS), security, and resource reservation, network packet classification is a crucial network kernel function. It became extremely challenging to classify arriving packets using the traditional packet classification algorithms at a decent pace due to the rapidly increasing size of rulesets and rule fields in current networks. In addition to hardware-based solutions, numerous contemporary software-based classification techniques have been put out to speed up packet classification. In general, it's critical to manage low latency, fast throughput, and higher energy efficiency with minimal memory needs while designing a packet classification method. In this paper, proposed the architecture makes use of the parallelism provided by current hardware technologies to classify numerous packets at once to improve throughput, reduce energy consumption, and significantly decrease the latency. The suggested high-speed parallel classification procedure uses two DPRAMs (DPRAM1 and DPRAM2) to support multiple read of the data. DPRAMs(Dual Port Random Access Memories) are preferred for stage memory because of their low latency performance, which enables quick rate packet lookup. The packet scheduling module receives the data from the DPRAM. The four successive packet splitter modules receive the packets in parallel. As a result, the packet classification throughput increased. To optimize throughput, and latency while maintaining low energy consumption, facilitating parallel packet classification architecture on FPGA is discussed in this work. Several parameters, including throughput, latency, energy efficiency, and memory requirements, will be evaluated and compared to traditional methods to assess performance. The classifier offers less latency of 51 ns and the lowest energy efficiency of 5.2 nJ, and its throughput may approach 802 million packets per second at the rate of 420 MHz clock frequency.

A Learned Bloom Filter-Assisted Scheme for Packet Classification in Software-Defined Networking

Traditional routing technologies based on a single IP address domain faces the challenge to meet the increasing demand for network services and security. Packet classification is a technique to differentiate multi-domain network traffic in a fine-grained manner using packet header fields. Packet classification requires to operate efficiently to avoid it becoming a bottleneck in the packet routing process. Tuple space search (TSS) used in SDN supports fast rule updates but low-speed packet classification. In this paper, we propose a learned Bloom filter (LBF)-based packet classification algorithm that combines LBF and TSS to promote classification speed by avoiding invalid hash table accesses. Specifically, LBF consists of multiple RNN models and one support Bloom filter (SBF), in which the learned models are trained with the positive and negative sets, and used as a pre-filter to identify the two sets. For the filter outcomes with a negative result from learned models, SBF is constructed to perform the second filtration. To ensure efficiency of RNN and SBF, we carefully select key features to be used in RNN and SBF, which can also maintain efficient search in the final stage of hash checking. Our experimental results show that the proposed algorithm saves more memory space than Tuple space pruning (TSP) given the same false positive rate. The proposed algorithm is competitive in terms of the number of memory accesses, while achieving almost one order of magnitude improvement on pre-processing time over NeuroCuts which is an advanced decision tree classifier.

ClassBench-ng: Benchmarking Packet Classification Algorithms in the OpenFlow Era

Packet classification, i.e., the process of categorizing packets into flows, is a first-class citizen in any networking device. Every time a new packet has to be processed, one or more header fields need to be compared against a set of pre-installed rules. This is done for basic forwarding operations, to apply security policies, application-specific processing, or quality-of-service guarantees. A lot of research efforts have identified better lookup techniques, i.e., finding the best match between packet headers and rules, by capitalizing on the rule sets characteristics. Here, ClassBench has greatly served the community by enabling the generation of IPv4 rule sets. In this paper, we present a new tool, ClassBench-ng, that creates synthetic IPv4, IPv6, and OpenFlow rules. We start from an analysis of classification rules deployed in-the-wild and we use the findings to craft our solution. ClassBench-ng can generate a user-defined number of rules as well as an associated header trace matching them. Compared to state-of-the-art solutions, the rule set generation process is usually more accurate and it is able to produce rules matching a number of different use cases, i.e., from an IPv4 router to an OpenFlow switch, which is unique among current rule set generation tools.

Algorithmic TCAMs: Implementing Packet Classification Algorithms in Hardware

The adoption of cloud computing and the deployment of new services require more and more computing and networking resources in large data centers. In particular, there is a need for faster, rich featured switches. Today, switching integrated circuits can handle more than 50 Tb/s and are expected to reach 100 Tb/s next year. This trend is likely to continue, approaching petabit capacities in a few years. At the same time, switches need to support more advanced packet classification features. This poses many challenges to the designers of switching integrated circuits, creating a need for innovations to move forward. One of those challenges is to support programmable packet classification with large rulesets at wire speed using limited silicon footprint. Unfortunately, traditional solutions like ternary content addressable memories (TCAMs) have high cost in area and power, and therefore are not a viable option for large on-chip rulesets, so new alternatives are needed. In the last two decades, researchers have extensively studied the problem of packet classification, proposing many algorithms based on standard memories, mostly targeting software implementations. These packet classification algorithms could be a solution to enable large on-chip classification rulesets using standard memories. However, porting the standard packet classification algorithms to a hardware implementation is not a trivial task, due to the different requirements and the different kinds of memory and computing resources available on application-specific integrated circuit (ASIC) switching chips. This article describes a packet classification design tailored for high-speed switching integrated circuits, which is currently used in the NVIDIA® Mellanox® Spectrum® switching ASIC product line, illustrating how to solve the mismatch between the usual software-based classification algorithms and the specific requirements of a hardware implementation.

Efficient hierarchical hash tree for OpenFlow packet classification with fast updates on GPUs

Packet classification is an important functionality of modern routers/switches, needed in packet forwarding, Quality of Service (QoS), firewall etc. In order to better utilize routers on the Internet, Software Defined Network (SDN) decouples control plane from data plane to fulfill centralized management. Based on OpenFlow standards, packet classification in SDN is designed for multi-field rules which are more complex than traditional 5-tuple rules. In the paper, we propose a novel packet classification algorithm, called hierarchical hash tree (H-HashTree), based on the two IP address fields and the 7 exact-match fields to partition rules into groups. An extended Bloom filter is also proposed to accelerate search process by skipping groups in the hash tree. To further improve the performance, H-HashTree is implemented on GPU. We tested on 100K rules including synthesized rules containing characteristics of ACL, FW, and IPC with different wildcard ratios in exact-match fields, and real OpenFlow rules from Open vSwitch. Compared with the existing state-of-the-art algorithms, CutTSS and TabTree [19][18], H-HashTree achieves the best performance on both search and update speeds. H-HashTree achieves 1.17-13.9 and 2.48-12.7 times faster in search speed and 2.03-6.0 and 1.87-4.53 times faster in rule updates from synthesized rulesets than CutTSS and TabTree, respectively. On the GPU platform, H-HashTree can achieve up to 114 MPPS in search speed and less than 0.04 usec/rule in rule updates.

DynamicTuple: The dynamic adaptive tuple for high-performance packet classification

The frequent rule updating in Software Defined Networking and cloud computing requires the packet classification algorithm to perform fast packet matching and flow table updating simultaneously. The existing algorithms, e.g. decision-tree-based or hash-based, achieve fast packet classification at the sacrifice of the rule updating or vice versa. We propose the Dynamic Adaptive Tuple (DynamicTuple) for both fast packet classification and rule updating simultaneously. DynamicTuple builds a performance model of tuple based packet classification and exploits dynamic programming to find the appropriate tuple formulation to minimize the lookup time. When the rules keep updating, DynamicTuple can retain the proper tuples and rebuild the improper tuples, thus the tuple in DynamicTuple is dynamic adaptive. The experimental results demonstrate that DynamicTuple achieves 33.1x, 5.6x, 5.7x classification speed and 2.9x, 11.0x, 8.5x updating speed compared to Tuple Space Search, TupleMerge, PartitionSort. By implementing DynamicTuple, the OpenFlow table of Open vSwitch achieves 26.6x classification speed.

ITOC: An Improved Trie-Based Algorithm for Online Packet Classification

With the development of SDN, packet classifiers nowadays need to be provided with low update latency besides fast lookup performance because switches need to respond to update control messages from controllers in time to guarantee real-time service in SDN implementations. Classification in this scenario is called online packet classification. In this paper, we put forward an improved trie-based algorithm for online packet classification (ITOC), in which we provide a trie selection strategy to avoid occasional high update latency in the update process of online trie-based algorithms. Experiments are conducted to validate the effectiveness of our optimization and compare the performance of ITOC with the offline methods, DPDK ACL. Experimental results demonstrate that ITOC has the same level of lookup speed with DPDK ACL and greatly decreased the update latency as well. The update latency of ITOC is only 6.85% of DPDK ACL library in the best case.

Trident: Efficient and practical software network monitoring

Network monitoring is receiving more attention than ever with the need for a self-driving network to tackle increasingly severe network management challenges. Advanced management applications rely on traffic data analyses, which require network monitoring to flexibly provide comprehensive traffic characteristics. Moreover, in virtualized environments, software network monitoring is constrained by available resources and requirements of cloud operators. In this paper, Trident, a policy-based network monitoring system at the host, is proposed. Trident is a novel monitoring approach, off-path configurable streaming, which offers remote analyzers a fine-grained holistic view of the network traffic. A novel fast path packet classification algorithm and a corresponding cached flow form are also proposed to improve monitoring efficiency. Evaluated in a practical deployment, Trident demonstrates negligible interference with forwarding and requires no additional software dependencies. Trident has been deployed in production networks of several Tier-IV datacenters.

CMT: An Efficient Algorithm for Scalable Packet Classification

AbstractPacket classification plays an essential role in diverse network functions such as quality of service, firewall filtering and load balancer. However, implementing an efficient packet classifier is a challenging problem. The problem even gets worse in the era of software-defined network, in which frequent rule updates are performed, and complex flow tables are used. This paper proposes CMT, a new software algorithm named by its novel data structure—common mask tree—to implement an efficient multi-field packet classifier. The core idea of CMT is to combine the strengths of both decision-tree and tuple-space schemes by employing tree-like structures and hash tables simultaneously. The objective of CMT is to achieve both high classification performance and fast rule updates. In the evaluation section, CMT is compared with decision-tree and tuple-space schemes. Compared to the state-of-the-art decision-tree methods, CMT performs rule updates at two orders of magnitude faster. CMT has a stable performance on different rulesets and achieves a 40% improvement in memory access compared to the state-of-the-art tuple-space method.

Efficient Flow Processing in 5G-Envisioned SDN-Based Internet of Vehicles Using GPUs

In the 5G-envisioned Internet of vehicles (IoV), a significant volume of data is exchanged through networks between intelligent transport systems (ITS) and clouds or fogs. With the introduction of Software-Defined Networking (SDN), the problems mentioned above are resolved by high-speed flow-based processing of data in network systems. To classify flows of packets in the SDN network, high throughput packet classification systems are needed. Although software packet classifiers are cheaper and more flexible than hardware classifiers, they could only deliver limited performance. A key idea to resolve this problem is parallelizing packet classification on graphical processing units (GPUs). In this paper, we study parallel forms of Tuple Space Search and Pruned Tuple Space Search algorithms for the flow classification suitable for GPUs using CUDA (Compute Unified Device Architecture). The key idea behind the offered methodology is to transfer the stream of packets from host memory to the global memory of the CUDA device, then assigning each of them to a classifier thread. To evaluate the proposed method, the GPU-based versions of the algorithms were implemented on two different CUDA devices, and two different CPU-based implementations of the algorithms were used as references. Experimental results showed that GPU computing enhances the performance of Pruned Tuple Space Search remarkably more than Tuple Space Search. Moreover, results evinced the computational efficiency of the proposed method for parallelizing packet classification algorithms.

A Fast, Smart Packet Classification Algorithm Based on Decomposition

Packet classification algorithms have been the focus of research for the last few years, due to the vital role they play in various services based on packet forwarding. However, as the number of rules in the rule set increases, not only the preprocessing time but also the memory consumption is increasing greatly. In this paper, we first model and analyze the above issue in depth. Then, a fast, smart packet classification algorithm based on decomposition is proposed. By boundary-based rule traversal and smart rule set partitioning, both the preprocessing time and memory consumption are reduced dramatically. Experimental results show that the preprocessing time of our method achieves 8.8-time improvement at maximum compared with the PCIU and achieves about 31.5-time improvement on average compared with CutSplit for large rule sets. Meanwhile, the memory overhead is reduced by 40% at maximum and 27.5% on average compared with the PCIU.

Efficient parallelisation of the packet classification algorithms on multi‐core central processing units using multi‐threading application program interfaces

The categorisation of network packets according to multiple parameters such as sender and receiver addresses is called packet classification. Packet classification lies at the core of Software-Defined Networking (SDN)-based network applications. Due to the increasing speed of network traffic, there is an urgent need for packet classification at higher speeds. Although it is possible to accelerate packet classification algorithms through hardware implementation, this solution imposes high costs and offers limited development capacity. On the other hand, current software methods to solve this problem are relatively slow. A practical solution to this problem is to parallelise packet classification using multi-core processors. In this study, the Thread, parallel patterns library (PPL), open multi-processing (OpenMP), and threading building blocks (TBB) libraries are examined and implemented to parallelise three packet classification algorithms, i.e. tuple space search, tuple pruning search, and hierarchical tree. According to the results, the type of algorithm and rulesets may influence the performance of parallelisation libraries. In general, the TBB-based method shows the best performance among parallelisation libraries due to using a theft mechanism and can accelerate the classification process up to 8.3 times on a system with a quad-core processor.

Investigating the efficiency of multithreading application programming interfaces for parallel packet classification in wireless sensor networks

This paper investigates the most appropriate application programming interface API that best accelerates the flow-based applications on the wireless sensor networks WSNs . Each WSN include many sensor nodes which have limited resources. These sensor nodes are connected together using base stations. The base stations are commonly network systems with conventional processors which are responsible for handling a large amount of communicated data in flows of network packets. For this purpose, classification of the communicated packets is considered the primary process in such systems. With the advent of high-performance multicore processors, developers in the network industry have considered these processors as a striking choice for implementing a wide range of flow-based wireless sensor networking applications. The main challenge in this field is choosing and exploiting an API which best allows multithreading; i.e. one which maximally hides the latency of performing complex operations by threads and increases the overall efficiency of the cores. This paper assesses the efficiency of Thread, Open Multiprocessing, and Threading Building Blocks TBB libraries in multithread implementation of set-pruning and grid-of-tries packet classification algorithms on dual-core and quad-core processors. In all cases, the speed and throughput of all parallel versions of the classification algorithms are much more than the corresponding serial versions. Moreover, for parallel classification of a sufficiently large number of packets by both classification algorithms, TBB library results in higher throughput and performance than the other libraries due to its automatic scheduling and internal task stealing mechanism.

Enhancing the performance of decision tree-based packet classification algorithms using CPU cluster

Packet classification is a essential process in network processors. In this process, the incoming packets are matched against a set of filters and divided into specified streams. Classification methods are either software-based or hardware-based. Despite hardware-based methods, software-based methods are more flexible and have a lower cost. This paper reports on an experiment in which the Hierarchical-trie (H-trie) algorithm, which is a software-based method, was for the first time parallelized using the CPU cluster. The characteristic of this algorithm is building a decision tree with the least memory usage and search complexity. We implemented and executed different scenarios by using MPI and OpenMP and combining them in a system with a single multi-core processor as well as multi-core processor clusters. Our results suggest that an increase in the number of processor cores would linearly increase the speed of classification. Moreover, MPI uses more memory than OpenMP but provides a higher rate of classification. The results of the combined method show that, if the number of processes and threads are equal to the number of processor cores, the maximum speed of packet classification can be achieved. Also, the least classification time and memory usage can be achieved when the sum of processes and threads do not outnumber CPU cores.

Packet Classification Using GPU and One-Level Entropy-Based Hashing

The demand for on-line analyzing of internet traffic for both security and QoS consideration directly increases as a function of using diverse applications and as malicious attacks increase. This paper presents a new fast parallel packet classification algorithm based on entropy hashing. The algorithm uses a one-level hashing data structure and enables partitioning a very large rules-set into smaller uniformly distributed sub-rules look-up tables based on maximum entropy and Most Significant Bit (MSB) pattern hash keys. This minimizes the classifier searches only to the relevant appropriate look-up table using the same hash key, and therefore significantly shortens the classification process. A further speed-up factor is achieved by parallelizing the classification algorithm using Nvidia Graphics Processing Unit (GPU). The proposed algorithm is applied to both ACL and FW applications using common synthetic rules-sets of size up to 500k rules. The simulation results show that the proposed algorithm outperforms existing classifiers in terms of both speed up and memory utilization. The required memory size is significantly reduced, and a classification speed-up factor of up to 200 is demonstrated compared to a similar serial approach.

Ingredients to enhance the performance of two-stage TCAM-based packet classifiers in internet of things: greedy layering, bit auctioning and range encoding

Using packet classification algorithms in network equipment increases packet processing speed in Internet of Things (IoT). In the hardware implementation of these algorithms, ternary content-addressable memories (TCAMs) are often preferred to other implementations. As a common approach, TCAMs are used for the parallel search to match packet header information with the rules of the classifier. In two-stage architectures of hardware-based packet classifiers, first the decision tree is created, and then the rules are distributed among its leaves. In the second step, depending on the corresponding leaves, the second part of the rules, which includes the range of source and destination ports is stored in different blocks of TCAM. Due to inappropriate storage of port range fields, the existing architectures face the problem of wasting memory and growing power consumption. This paper proposes an efficient algorithm to encode the port range. This algorithm consists of three general steps including layering, bit allocation, and encoding. A greedy algorithm in the first step places the ranges with higher weights in higher layers. Next, an auction-based algorithm allocates several bits to each layer depending on the number of the ranges in that layer. Finally, in each layer, depending on the weight order of the ranges, the bits are given values for the intended range. The evaluation results show that unlike previous methods of storing range fields, the proposed method not only increases the speed of the classification but also uses the capacity of TCAM in the second stage more efficiently.

Pruned Kd-tree: a memory-efficient algorithm for multi-field packet classification

Packet classification is a basic process in most network-based packet processing systems. The key operation in this process is to match the packet header against the rules defined in a rule-set and, finally, to find the best matching rule. One of the well-known algorithms for packet classification is the Kd-tree algorithm. This algorithm produces a binary tree using the tuples created by the length of the prefix of the source and destination IP addresses of the rules. The tree is intended to classify the packets. The efficiency of the mechanism for producing and searching the binary tree in this algorithm is affected by two major disadvantages, namely, redundant nodes and redundant accesses during the search. The former increases memory consumption and the latter slows down packet classification. The proposed idea in this article is to prune redundant nodes by sorting the rules corresponding to each tuple in the tree nodes. The experimental results suggest that the throughput rate of the pruned Kd-tree is 43.64% higher than the Kd-tree. Also, by pruning the structure of the Kd-tree, our proposed method could at best reduce 24% of the memory consumed for the storage of the data structure of the Kd-tree.

Memory Optimization for Bit-Vector-Based Packet Classification on FPGA

High-performance packet classification algorithms have been widely studied during the past decade. Bit-Vector-based algorithms proposed for FPGA can achieve very high throughput by decomposing rules delicately. However, the relatively large memory resources consumption severely hinders applications of the algorithms extensively. It is noteworthy that, in the Bit-Vector-based algorithms, stringent memory resources in FPGA are wasted to store relatively plenty of useless wildcards in the rules. We thus present a memory-optimized packet classification scheme named WeeBV to eliminate the memory occupied by the wildcards. WeeBV consists of a heterogeneous two-dimensional lookup pipeline and an optimized heuristic algorithm for searching all the wildcard positions that can be removed. It can achieve a significant reduction in memory resources without compromising the high throughput of the original Bit-Vector-based algorithms. We implement WeeBV and evaluate its performance by simulation and FPGA prototype. Experimental results show that our approach can save 37% and 41% memory consumption on average for synthetic 5-tuple rules and OpenFlow rules respectively.