Packet Classification on Multiple Fields Pankaj Gupta and Nick McKeown Stanford University {pankaj, September 2, 1999

Multi-field Packet Classification Given a classifier with N rules, find the action associated with the highest priority rule matching an incoming packet. Example: A packet ( , , …, TCP) would have action A2 applied to it.

Performance Metrics of a Classification Algorithm l Data structure storage requirements l Packet classification time l Preprocessing time l Incremental Update time

Background Grid of Tries (V. Srinivasan et al [Sigcomm 98]) Bit-level Parallelism (D. Stiliadis et al [Sigcomm 98]) Hierarchical Cuttings (P. Gupta et al [Hot Interconnects 99])

Space-time tradeoff Point Location among N non-overlapping regions in k dimensions: either O(log N) time with O(N k ) space, or O(log k-1 N) time with O(N) space Need help: exploit structure in real-life classifiers.

Our Dataset l 793 classifiers from 101 ISP and enterprise networks with a total of rules. l 40 classifiers: more than 100 rules. Biggest classifier had 1733 rules. l Maximum of 4 fields per rule: source IP address, destination IP address, protocol and destination port number.

Structure of the Classifiers R1 R2 R3 4 regions

Structure of the Classifiers R1 R2 R3 {R1, R2} {R2, R3}{R1, R2, R3} 7 regions Our dataset: 1733 rule classifier = 4316 distinct regions (worst case is !)

One-Step Classification

Recursive Flow Classification (RFC)

Chunking of a packet Source L3 Address Destination L3 Address L4 protocol and flags Source L4 port Destination L4 port Type of Service Packet Header Chunk #0 Chunk #7

Packet Flow Phase 0Phase 1Phase 2Phase 3 index action Header Combination Reduction

Example Classifier

Formation of regions {20-21, HTTP, > 1023, *} 21

Reduction indexeqID

162 2 Protocol L4 port 43 Combination

Regions/Equivalence Classes Successive reduction + combination: final action

Packet Flow Phase 0Phase 1Phase 2Phase 3 index action Header Reduction

Choice of Reduction Tree Number of phases = P = 3 10 memory accesses Number of phases = P = 4 11 memory acceses

Storage Requirements Number of Rules Memory in Mbytes

Preprocessing Time Number of Rules Time in seconds 333Mhz Pentium-II with 96MB RAM running Linux.

Classification Time l Pipelined hardware: 30 Mpps (worst case OC192) using two 4Mb SRAMs and two 64Mb SDRAMs at 125MHz. l Software: (3 phases)1 Mpps in the worst case and Mpps in the average case. (average case OC48) [performance measured using Intel Vtune simulator on a windows NT platform]

Larger classifiers Number of Rules Memory in Kbytes

Conclusions l Difficult to achieve both high classification rate and reasonable storage in the worst case. l Real classifiers exhibit structure and redundancy. l The proposed classification scheme, RFC, seems to be of practical use where classifiers do not change very frequently.