4Multi-field Packet Classification Given a classifier with N rules, find the action associated with the highest priority rule matching an incoming packet.Example: A packet ( , , …, TCP) would have action A2 applied to it.
5Performance Metrics of a Classification Algorithm Data structure storage requirementsPacket classification timePreprocessing timeIncremental Update time
12Decision Tree using Hierarchical Intelligent Cuttings (HiCuts) With each internal node v, associate:A rectangle, or a box B(v)A set of rules, CollidingRuleSet, R(v)A HiCut C(v) = (dimension d, #partitions of B(v) across d)
15HiCut Decision Tree for binth = 2 (256 * 256, X, 4)Packet P(65, 130)(64*256, Y, 2)R1R2R2R2R6R7R4R2R5R6
16Heuristics to exploit classifier structure Picking a suitable dimension to hicut across.Minimize the maximum number of rules into any one partition, ORMaximize the entropy of the distribution of rules across the partition, ORMaximise the different number of specifications in one dimensionPicking the suitable number of partitions (HiCuts) to be made.Affects the space consumed and the classification time. Tuned by a parameter, spfac.
17Tunable ParametersBinth, the maximum size of the set of rules at each leafSpfac, a parameter which guides the partitioning process to choose the number of partitions
18Implementation Results: Four dimensional real-life classifiers 40 access-lists taken from real ISP and enterprise networksFour dimensions: (Src IP, Dst IP, L4 protocol, L4 destination port)rules
19Number of Memory Accesses Number of Rules (log scale) CrossproductingNumber of Rules (log scale)Binth = 8, spfac = 4
20Size of the data structure Space in KiloBytes (log scale)Number of Rules (log scale)Binth = 8 ; spfac = 4
21Comparison with Crossproducting Space in MegaBytes (log scale)Number of Rules (log scale)Binth = 8 ; spfac = 4
22Time in seconds (log scale) Number of Rules (log scale) Preprocessing TimeTime in seconds (log scale)Number of Rules (log scale)Binth = 8, spfac = 4, 333MHz P-II running Linux
23Incremental Update Time Time in seconds (log scale)Number of Rules (log scale)Binth = 8, spfac = 4 , 333MHz P-II running Linux
24ConclusionsExploiting the structure of classifiers is important for a good solution.The proposed HiCut packet classification scheme seems to be of practical use.
25In the paper...Explanation of the heuristics used in building the HiCut decision tree.Detailed implementation results.Effect of the parameters binth and spfac on the depth and space characteristics.Available at: