1. SSA: A Power and Memory Efficient Scheme to Multi-Match Packet Classification Fang Yu 1 T. V. Lakshman 2 Martin Austin Motoyama 1 Randy H. Katz 1 1 EECS Department, UC Berkeley, 2 Bell Laboratories, Lucent Technologies

2. Single-Match Classification  Assumption: all the filters are associated with priorities  Only the highest priority match matters  E.g., longest prefix match Multi-Match Classification  Report all matching results  No priority among filters  Applications: Intrusion Detection Systems: identify all the related rules Accounting Applications: update multiple counters given one packet Multi-Match Packet Classification

3. Ternary-CAM (TCAM) Fully associative memory compare input string with all the entries in parallel  If multiple matches, report the index of the first match  Each cell takes one of three logic states : ‘0’, ‘1’, and ‘?’(don’t care) Current TCAM technology  Fast match time: e.g., 4 ns  Size: 9Mbits – 18Mbits priced at $200-$300  Power consumption is high Grow linearly to the number of entries searched in parallel Scales with the frequency of TCAM accesses.

4. Previous Solutions: Geometric Intersection- based Solution [Hot Interconnects 04] Add additional intersection filters  Return the all the matching results within one cycle  May require high storage and is not energy efficient Create ~10N intersection filters for the Snort rule set May create O(N F ) intersection filters in the worst case  Not easily updatable

5. Previous Solution: MUD [ Sigcomm 05] Encode the index of the entry and include the encoded value in each TCAM entry  Search the TCAM with initial MUD as all don’t cares  After finding a matching result at index j, search again discriminator field value ‘greater than j’ Require 1+d+(k-2)*(d-1) TCAM lookups to get k matching results  d is the logarithm of the number of entries in TCAM (d=log2N)  decreased to 1+d*(k-1)/r with DIRPE, where r (smaller than d)  All the entries in TCAMs are accessed each time  high power consumption. Our Goal: Find a memory and power efficient solution

6. Observation Split filters to two sets to reduce intersection  Perform separate TCAM accesses into different sets  Report the union of results from all sets N filters +O(N 2 ) intersection 1 TCAM lookup N filters + 1 intersection 2 TCAM lookups Original Two sets F1F1 FNFN Matching F 1 and F N Matching F 1 Matching F N

7. Analysis: Split Filters into K Sets No need to include the intersections of the filters from different sets  low memory requirement Perform one TCAM lookups into each set  Each filter is accessed only once  Low power consumption  Total number of lookups (K) is independent to the multi- matching degree of the packet  Deterministic lookup rate  These lookups are can parallelized  Update is local to one of the set

8. Split filters into Multiple Sets Splitting filters into multiple sets is an NP hard problem Splitting filters into two sets is still an NP hard problem (known as maximum set splitting or maximum hypergraph cut )  Best known approximation algorithms Yield a performance ratio of 0.72 to the optimum solution Require quadratic programming  slow when the number of filters is large We propose a set splitting algorithm (SSA) based on Johnson’s algorithm Guarantee to remove at least 50% of the intersections O(NM) complexity, where N is the total number of filters, and M is the total number of intersections

9. Simulation Results on Snort Rule Sets Total number of extra intersections filters in TCAMs. Version Geometric Intersection- based SSA-2SSA-4 Extra Intersections Saving Extra Intersections Saving 2.0.034534698.67%199.97% 2.0.137544798.75%199.97% 2.1.037584798.75%0100% 2.1.140675598.65%0100% Memory Consumption: Total number of TCAM entries VersionMUD Geometric Intersection-based SSA-2SSA- 4 2.0.02403693286241 2.0.12554009302256 2.1.02574015304257 2.1.12634330318263 VersionMUD Geometric Intersection- based SSA-2SSA-4 AvgMaxAvgMaxAvgMax 2.0.0131.731571.33171.0022 2.0.1135.241351.341911 2.1.0134.711351.36201.0022 2.1.1136.001721.41261.0062 Update cost in terms of newly inserted filters. Power Consumption: TCAM entries accessed per packet.

10. Conclusion SSA can solve multi-match classifying problem efficiently  O(NM) complexity  Guarantee to remove 50% of the intersections each time the filter set splits  Comparing to MUD Use a similar amount of TCAM memory Yield a 75% to 95% reduction in power consumption  Comparing to the Geometric Intersection-based Solution Use 90% less TCAM memory and power Require one additional TCAM lookup per packet.