1. Worst-Case TCAM Rule Expansion Ori Rottenstreich (Technion, Israel) Joint work with Isaac Keslassy (Technion, Israel)

2. Packet Classification Action ---- RuleAction Policy Database (classifier) Packet Classification Forwarding Engine Incoming Packet HEADERHEADER

3. Power Consumption in a Router Sources: R.S. Tucker, based on Cisco CRS-1, 2009; D. Hay Packet Classification }

4. Ternary Content-Addressable Memory (TCAM) Encoder Match lines Packet Header (Search Key) 0 1 2 3 4 6 5 7 8 9 2 0 1 2 3 4 6 5 7 8 9 accept deny accept TCAM Array Each entry is a word in {0,1,  } W

5. Example Encoder Match lines 0 1 2 3 4 6 5 7 8 9 deny log accept deny limit deny accept 0011101101010  00  01001111  11  00  00001110  0  101000110  10  010100  0  0100011010  01000 001110  1110  010  01  0010101010  0  11  10010  01  0010  10  01   001110  10101010   111111111111111111111111  0011101010101001110001110001110 0 0 0 1 0 1 0 1 0 1 3 

6. Range Rules RuleSource address Source port Dest- address Dest- port Prot ocol Action Rule 1 123.25.0.0/1680255.2.3.4/32 80TCP Accept Rule 2 13.24.35.0/24>1023255.2.127.4/315556 TCP Deny Rule 3 16.32.223.1420-50255.2.3.4/3150-70 UDP Accept Rule 4 22.2.3.41-6255.2.3.0/2120-22 TCP Limit Rule 5 255.2.3.412-809255.2.3.417-190 ICMP Log  Range rule = rule that contains range field  Usually source-port or dest-port

7. Range Rule Representation in TCAM  Assume we want to represent a range in a single field of W bits  Our objective: minimize the number of TCAM entries needed to encode the range  More TCAM entries represent more power consumption  Some ranges are easy to represent Example: W=3: [4, 7] = {100,101,110,111} = 1   But what about [1,6] ?

8.  Range [1,6] in tree of all elements with W=3 bits: (Internal) Encoding of [1,6] 010011001110100101 111000 Known result: expansion in 2W-2 TCAM entries Here: 2W-2=4 TCAM entries

9. Outline  Introduction  Worst-case range expansion  New TCAM architectures

10. External Encoding 010011001110100101 111000 Here: W=3 TCAM entries (instead of 4) Idea to reduce number of TCAM entries: exploit TCAM entry order by encoding range complimentary as well

11. New upper bounds on the worst-case rule expansion  Theorem 1: Expansion of W-bit range in at most W TCAM entries  Note: W instead of 2W-2  Note: also in next talk  Theorem 2: W TCAM entries is optimal among prefix codes (not shown in this paper)  Theorem 3: Expansion of k W-bit ranges in k·W TCAM entries

12. Union of k ranges in kW 010011001 110 100101111 000 R 1 =[1,5], R 2 =[7,7] R=R 1 UR 2 can be encoded using k·W=2·3=6 TCAM entries  Theorem 3: Expansion of k W-bit ranges in k·W TCAM entries  Example:

13. Multi-field Ranges Known result: range expansion in d W-bit fields in (2W-2) d TCAM entries Theorem 4: Expansion in O(d·W) TCAM entries (i.e. linear in d) without any additional logic

14. Outline  Introduction  Worst-case range expansion  New TCAM architectures

15. New TCAM architectures  Using additional logic to reduce expansion  Example for W=4

16. (a) Known Architecture: Internal – Product 5 6 3 1  Expansion of 6·5 + 3·1 = 33

17. (a) Internal - Product header 1000.0111 (range 1) PE (0) (1) (0)  Worst-case expansion of k·(2W-2)^d

18. (b) Combined - Product 5454 6 3 3 1  Expansion of 3·4 + 3·1 = 15

19. (0) (1) header 1000.0111 PE (range 1) (0) (1) (0) (b) Combined - Product  Worst-case expansion of k·W^d

20. (c) Combined – Sum 4 3 3 1  Expansion of 3+4 + 3+1=11

21. (0) (1) (0) header 1000.0111 PE (range 1) (1) (c) Combined – Sum  Worst-case expansion of k·d·W

22. Architecture Summary known new

23. Experimental Results  On real-life rule set  120 separate rule files from various applications Firewalls, ACL-routers, Intrusion Prevention systems  215K rules  280 unique ranges  Used as a common benchmark in literature

24. Experimental Results 39% Better 57% Better

25. Summary  Expansion of W-bit range in at most W TCAM entries (instead of 2W-2)  Optimal (among prefix codes)  Linear expansion for multi-field ranges  New TCAM architectures  Up to 39% less TCAM entries

26. Thank You