Author Name Security and Networks Research Group Department of Computer Science Rhodes University SNRG SLIDE TEMPLATE

Started my literature review WORKED FOR FESTIVAL Finished my literature review (Ordered a new toy) What’s happened since last time?

The packet classification problem Overview of literature review –Classification algorithms –Deep packet inspection algorithms Plan of action Contents

The packet classification problem Most packets contain the basic 5-tuple (Source/Destination IP addresses, Source/Destination port numbers, protocol numbers). The 5-tuple can determine much of packet routing and how packets should be handled (dropped, ignored, allowed etc.). Different combinations of values of fields in the 5-tuple require different actions i.e. match different filters. Reactions to packets can also be based on the contents of the packet’s payload; may depend on packet’s context/classification. The packet classification problem aims to determine what response a packet should elicit given its field properties and payload contents. (Packet classification tends to ignore deep packet inspection)

Linear/Parallel search LinearvsParallel Easy to implement Reliable Not very fast Very fast Very fast (and reliable) Resource expensive TCAMs

Useful for prefix ranges Good for 2D filters, worse for >2D Optimisations include branch pruning and cross-trie pointers Grid-of-tries

A geometric approach to packet classification 1.Determine the set of applicable filters for each field 2.Intersection of filters yields applicable filters for whole packet Also lends itself to parallelism Address 10; port 7: yield AND > Bit vectors Address 10Port AND Filter: j

The BV-TCAM architecture Song and Lockwood observed that in a filter set there are few unique IP addresses or address masks but many protocols and port numbers Used TCAM’s for IP address matching – small variety of unique addresses TCAM output was encoded in a bit vector Grid-of-tries used for protocol matching – protocol determined which set of tries to search Output also in the form of a bit vector Intersection of bit vectors yielded final set of matched filters Designed achieved 2.5 Gbps

N parallel rule checks N comparators each search for a string at each offset within the packet Header processing and payload inspection can be pipelined to increase throughput. Sourdis and Pnevmatikatos achieved 10Gbps throughput.

Deterministic finite state automata Regular expressions - Vi(R|r)u(S|s) Deterministic automata were created using software tools and then mapped to FPGAs Each DFA searched for a separate string Achieved a throughput of 1.2Gbps – 2.5Gbps

Comments on literature Packet classification is a well rehearsed problem Many different solutions Leverage the well known header structure of received packets Deep packet inspection is a much harder problem to solve Obfuscated appearance of most packet payloads Greater need for raw processing power and parallelized implementations

Future project progress Currently: Waiting for new FPGA development board Browsing through Xilinx SDK to familiarise myself with Ethernet interfacing on the FPGA Searching the Internet for other open-source TCP/IP or Ethernet processing code segments Still to do: Finish implementation of complete system Testing and timings of final system Write report