4 Multi-field Packet Classification Given a classifier with N rules, find the action associated with the highest priority rule matching an incoming packet.Example: A packet ( , , …, TCP) would have action A2 applied to it.
5 Performance Metrics of a Classification Algorithm Data structure storage requirementsPacket classification timePreprocessing timeIncremental Update time
12 Decision Tree using Hierarchical Intelligent Cuttings (HiCuts) With each internal node v, associate:A rectangle, or a box B(v)A set of rules, CollidingRuleSet, R(v)A HiCut C(v) = (dimension d, #partitions of B(v) across d)
15 HiCut Decision Tree for binth = 2 (256 * 256, X, 4)Packet P(65, 130)(64*256, Y, 2)R1R2R2R2R6R7R4R2R5R6
16 Heuristics to exploit classifier structure Picking a suitable dimension to hicut across.Minimize the maximum number of rules into any one partition, ORMaximize the entropy of the distribution of rules across the partition, ORMaximise the different number of specifications in one dimensionPicking the suitable number of partitions (HiCuts) to be made.Affects the space consumed and the classification time. Tuned by a parameter, spfac.
17 Tunable ParametersBinth, the maximum size of the set of rules at each leafSpfac, a parameter which guides the partitioning process to choose the number of partitions
18 Implementation Results: Four dimensional real-life classifiers 40 access-lists taken from real ISP and enterprise networksFour dimensions: (Src IP, Dst IP, L4 protocol, L4 destination port)rules
19 Number of Memory Accesses Number of Rules (log scale) CrossproductingNumber of Rules (log scale)Binth = 8, spfac = 4
20 Size of the data structure Space in KiloBytes (log scale)Number of Rules (log scale)Binth = 8 ; spfac = 4
21 Comparison with Crossproducting Space in MegaBytes (log scale)Number of Rules (log scale)Binth = 8 ; spfac = 4
22 Time in seconds (log scale) Number of Rules (log scale) Preprocessing TimeTime in seconds (log scale)Number of Rules (log scale)Binth = 8, spfac = 4, 333MHz P-II running Linux
23 Incremental Update Time Time in seconds (log scale)Number of Rules (log scale)Binth = 8, spfac = 4 , 333MHz P-II running Linux
24 ConclusionsExploiting the structure of classifiers is important for a good solution.The proposed HiCut packet classification scheme seems to be of practical use.
25 In the paper...Explanation of the heuristics used in building the HiCut decision tree.Detailed implementation results.Effect of the parameters binth and spfac on the depth and space characteristics.Available at: