Worst-Case TCAM Rule Expansion Ori Rottenstreich (Technion, Israel) Joint work with Isaac Keslassy (Technion, Israel)

Packet Classification Action ---- RuleAction Policy Database (classifier) Packet Classification Forwarding Engine Incoming Packet HEADERHEADER

Power Consumption in a Router Sources: R.S. Tucker, based on Cisco CRS-1, 2009; D. Hay Packet Classification }

Towards a Hardware Solution  Rules in the policy database can be written in a ternary alphabet, using 0,1,  

Ternary Content-Addressable Memory (TCAM) Encoder Match lines Packet Header (Search Key) accept deny accept TCAM Array Each entry is a word in {0,1,  } W

Example Encoder Match lines deny log accept deny limit deny accept  00   11  00   0   10   0    1110  010  01   0  11   01  0010  10  01       

Outline  Packet Classification and TCAM devices  Representing range rules  Contributions  New upper bounds on the worst-case rule expansion  Linear expansion of multidimensional rules  New TCAM architectures  Conclusions

Range Rules RuleSource address Source port Dest- address Dest- port Prot ocol Action Rule / /32 80TCP Accept Rule /24> / TCP Deny Rule / UDP Accept Rule / TCP Limit Rule ICMP Log  Range rule = rule that contains range field  Usually source-port or dest-port

Range Rule Representation in TCAM  Assume we want to represent a range in a single field of W bits  Our objective: minimize the number of TCAM entries needed to encode the range  More TCAM entries represent more power consumption  Some ranges are easy to represent Example: W=3: [4, 7] = {100,101,110,111} = 1   But what about [1,6] ?

 Range [1,6] in tree of all elements with W=3 bits: (Internal) Encoding of [1,6] Known result: expansion in 2W-2 TCAM entries Here: 2W-2=4 TCAM entries

Prefix Expansion  Use multiple entries to code a single rule [1,6]= {001, 01 ,10 , 110} – 4 entries  Every rule that contains [1,6] needs 4 entries  Maximum expansion 2W-2 for range [1,2 W -2] (W is the field width)  For rules with two range fields, we need the Cartesian product of the expansion  Active research to reduce this cost: [Yu, Katz], [Spitznagel, Taylor and Turner], [Liu], [van Lunteren, Engbersen], [Che, Wang, Zheng, Liu] [Lakshminarayanan, Rangarajan, Venkatachary] … [Srinivasan, Varghese, Suri, Waldvogel; 1998]

Outline  Introduction  Worst-case range expansion  New TCAM architectures

External Encoding Here: W=3 TCAM entries (instead of 4) Idea to reduce number of TCAM entries: exploit TCAM entry order by encoding range complimentary as well

New upper bounds on the worst-case rule expansion  Theorem 1: Expansion of W-bit range in at most W TCAM entries  Note: W instead of 2W-2  Note: also in next talk  Theorem 2: W TCAM entries is optimal among prefix codes (not shown in this paper)  Theorem 3: Expansion of k W-bit ranges in k·W TCAM entries

Union of k ranges in kW R 1 =[1,5], R 2 =[7,7] R=R 1 UR 2 can be encoded using k·W=2·3=6 TCAM entries  Theorem 3: Expansion of k W-bit ranges in k·W TCAM entries  Example:

Multi-field Ranges Known result: range expansion in d W-bit fields in (2W-2) d TCAM entries Theorem 4: Expansion in O(d·W) TCAM entries (i.e. linear in d) without any additional logic

Outline  Introduction  Worst-case range expansion  New TCAM architectures

New TCAM architectures  Using additional logic to reduce expansion  Example for W=4

Example for W=4

(a) Known Architecture: Internal – Product  Expansion of 6·5 + 3·1 = 33

(a) Internal - Product header (range 1) PE (0) (1) (0)  Worst-case expansion of k·(2W-2)^d

(b) Combined - Product  Expansion of 3·4 + 3·1 = 15

(0) (1) header PE (range 1) (0) (1) (0) (b) Combined - Product  Worst-case expansion of k·W^d

(c) Combined – Sum  Expansion of =11

(0) (1) (0) header PE (range 1) (1) (c) Combined – Sum  Worst-case expansion of k·d·W

Architecture Summary known new

Experimental Results  On real-life rule set  120 separate rule files from various applications Firewalls, ACL-routers, Intrusion Prevention systems  215K rules  280 unique ranges  Used as a common benchmark in literature

Experimental Results 39% Better 57% Better

Implentation Considerations  Hot updates – Updates are easy to apply due to the TCAM’s devision into ranges  Multiple actions –No need to change the architecture in case of more actions than accept and deny

Future Directions  Coding scheme optimality ?  Over prefix encoding schemes  Over all encoding schemes  Over multidimensional ranges

Summary  Expansion of W-bit range in at most W TCAM entries (instead of 2W-2)  Optimal (among prefix codes)  Linear expansion for multi-field ranges  New TCAM architectures  Up to 39% less TCAM entries

Thank You