1. Packet Classification on Multiple Fields Pankaj Gupta and Nick McKeown Stanford University {pankaj, nickm}@stanford.edu September 2, 1999

2. Multi-field Packet Classification Given a classifier with N rules, find the action associated with the highest priority rule matching an incoming packet. Example: A packet (152.168.3.32, 152.163.171.71, …, TCP) would have action A2 applied to it.

3. Performance Metrics of a Classification Algorithm l Data structure storage requirements l Packet classification time l Preprocessing time l Incremental Update time

4. Background Grid of Tries (V. Srinivasan et al [Sigcomm 98]) Bit-level Parallelism (D. Stiliadis et al [Sigcomm 98]) Hierarchical Cuttings (P. Gupta et al [Hot Interconnects 99])

5. Space-time tradeoff Point Location among N non-overlapping regions in k dimensions: either O(log N) time with O(N k ) space, or O(log k-1 N) time with O(N) space Need help: exploit structure in real-life classifiers.

6. Our Dataset l 793 classifiers from 101 ISP and enterprise networks with a total of 41505 rules. l 40 classifiers: more than 100 rules. Biggest classifier had 1733 rules. l Maximum of 4 fields per rule: source IP address, destination IP address, protocol and destination port number.

7. Structure of the Classifiers R1 R2 R3 4 regions

8. Structure of the Classifiers R1 R2 R3 {R1, R2} {R2, R3}{R1, R2, R3} 7 regions Our dataset: 1733 rule classifier = 4316 distinct regions (worst case is 10 13 !)

9. One-Step Classification

10. Recursive Flow Classification (RFC)

11. Chunking of a packet Source L3 Address Destination L3 Address L4 protocol and flags Source L4 port Destination L4 port Type of Service Packet Header Chunk #0 Chunk #7

12. Packet Flow Phase 0Phase 1Phase 2Phase 3 index action Header Combination 16 8 8 8 Reduction 128643216 14

13. Example Classifier

14. Formation of regions 020801024 65535 {20-21, HTTP, > 1023, *} 21

15. Reduction 0 20 1023 65535 21 00 01 10 11 10 1024 80 11 00 162 indexeqID

16. 162 2 Protocol L4 port 43 Combination

17. Regions/Equivalence Classes Successive reduction + combination: final action

18. Packet Flow Phase 0Phase 1Phase 2Phase 3 index action Header 168 8 8 Reduction

19. Choice of Reduction Tree 3 2 1 0 5 4 Number of phases = P = 3 10 memory accesses 3 2 1 0 5 4 Number of phases = P = 4 11 memory acceses

20. Storage Requirements Number of Rules Memory in Mbytes

21. Preprocessing Time Number of Rules Time in seconds 333Mhz Pentium-II with 96MB RAM running Linux.

22. Classification Time l Pipelined hardware: 30 Mpps (worst case OC192) using two 4Mb SRAMs and two 64Mb SDRAMs at 125MHz. l Software: (3 phases)1 Mpps in the worst case and 1.4-1.7 Mpps in the average case. (average case OC48) [performance measured using Intel Vtune simulator on a windows NT platform]

23. Larger classifiers Number of Rules Memory in Kbytes

24. Conclusions l Difficult to achieve both high classification rate and reasonable storage in the worst case. l Real classifiers exhibit structure and redundancy. l The proposed classification scheme, RFC, seems to be of practical use where classifiers do not change very frequently.