Computer Networks 56 (2012) Contents lists available at SciVerse ScienceDirect. Computer Networks

Transcription

1 Computer Networks 56 (2012) Contents lists available at SciVerse ScienceDirect Computer Networks journal homepage: A new hierarchical packet classification algorithm Hyesook Lim a,, Soohyun Lee a, Earl E. Swartzlander Jr. b a Department of Electronics Engineering, Ewha W. University, Seoul, Republic of Korea b Department of Electrical and Computer Engineering, The University of Texas at Austin, Austin, TX, United States article info abstract Article history: Received 8 September 2011 Received in revised form 9 March 2012 Accepted 17 April 2012 Available online 3 May 2012 Keywords: Packet classification Set-pruning Binary search tree Back-tracking Packet classification is one of the most challenging functions in Internet routers since it involves a multi-dimensional search that should be performed at wire-speed. Hierarchical packet classification is an effective solution which reduces the search space significantly whenever a field search is completed. However, the hierarchical approach using binary tries has two intrinsic problems: back-tracking and empty internal nodes. To avoid back-tracking, the hierarchical set-pruning trie applies rule copy, and the grid-of-tries uses pre-computed switch pointers. However, none of the known hierarchical algorithms simultaneously avoids empty internal nodes and back-tracking. This paper describes various packet classification algorithms and proposes a new efficient packet classification algorithm using the hierarchical approach. In the proposed algorithm, a hierarchical binary search tree, which does not involve empty internal nodes, is constructed for the pruned set of rules. Hence, both backtracking and empty internal nodes are avoided in the proposed algorithm. Two refinement techniques are also proposed; one for reducing the rule copy caused by the set-pruning and the other for avoiding rule copy. Simulation results show that the proposed algorithm provides an improvement in search performance without increasing the memory requirement compared with other existing hierarchical algorithms. Ó 2012 Elsevier B.V. All rights reserved. 1. Introduction One of the challenges in building an Internet router is in the design of an efficient packet forwarding engine [1]. The major functional blocks of a packet forwarding engine that require wire-speed processing are the IP address lookup and the packet classification. IP address lookup determines an output port using the destination IP address of an incoming packet [1 7]. Packet classification classifies an incoming packet based on predefined rules so that the packet can be provided with the service defined for the class to which it belongs [8 22]. For Internet routers to provide different service qualities for each packet flow, packet classification is an essential function. The time allocated to each packet is less than a few nanoseconds Corresponding author. Tel.: ; fax: address: hlim@ewha.ac.kr (H. Lim). for packets arriving at rates of giga bits or tera bits per second. Therefore, the packet processing speed is of primary importance. The use of application-specific integrated circuits (ASICs) with off-chip ternary content addressable memories (TCAMs) has been the best solution in providing wire-speed packet forwarding [23 25]. However, TCAMs consume 150 times more power per bit than SRAMs. TCAMs also cost about 30 times more per bit of storage than DDR SRAMs. Another issue is the rule duplication problem related to the port number fields. The port number fields can be a fixed number or a range specified by low and/or high boundaries. If a rule has the field specified by a range, the range has to be converted into multiple prefixes, and the rules with each converted prefix are then stored into a TCAM entry. Since a port range can be converted into a maximum of 30 prefixes, if two port fields are specified by ranges, a maximum of 900 TCAM entries are required. Therefore, efficient packet classification /$ - see front matter Ó 2012 Elsevier B.V. All rights reserved.

2 H. Lim et al. / Computer Networks 56 (2012) algorithms using ordinary memories such as SRAMs are required. Packet classification speed can be evaluated by the number of memory accesses in an algorithmic approach since memory lookup is the slowest operation in the search process. Hierarchical approaches are very effective in providing high-speed search performance since the search space is significantly reduced whenever a one-dimensional search is completed. However, the existing hierarchical approach has two challenges: back-tracking and empty internal nodes. In an attempt to avoid back-tracking, the hierarchical set-pruning trie [11] uses a set-pruning, in which rules included in the ancestor nodes are copied into all the descendant nodes. The grid-of-tries [14] computes switch pointers in advance. However, there is no known algorithm that simultaneously avoids back-tracking and empty internal nodes. This paper describes several hierarchical packet classification algorithms and proposes a new algorithm. The proposed algorithm constructs a hierarchical binary search tree, which does not include empty internal nodes, for the pruned set of rules. In other words, the proposed algorithm uses set-pruning to avoid back-tracking and uses a binary search tree to avoid empty internal nodes. Hence the proposed algorithm improves the search performance as well as eliminates the memory overhead of empty nodes. However, because of the set-pruning applied to our proposed algorithm, rules are heavily replicated. Two refinement techniques are suggested for reducing or completely removing the memory overhead caused by the set-pruning. The first proposed refinement technique is to use controlled rule copy. Since rules with a wildcard in the first field are copied into every second-field tree by the set-pruning and rules with a wildcard usually have low priorities, by building a separate tree for rules with a wildcard, the controlled rule copy technique significantly reduces the number of replicated rules. The second proposed refinement technique is to use ancestor pointers without the set-pruning. Based on the nesting relationship of the first field, the hierarchy of second-field trees is identified. An ancestor pointer points to the second-field tree of its direct ancestor. Since rules with more specific prefixes generally have higher priorities, if a matching rule with the most specific prefixes is identified first, it is more likely that the rule is the best matching rule, and hence the tree search can be avoided for most of the inputs by just comparing with the highest priority number of each second-field tree. This paper is organized as follows. In Section 2, the packet classification problem is formally defined. Section 3 describes previous hierarchical packet classification algorithms and their characteristics. Section 4 describes the proposed hierarchical set-pruning binary search tree (HSP-BST). Section 5 suggests two refinement techniques of our proposed algorithm. Section 6 shows the simulation results of the proposed algorithms and provides a comparison with other existing algorithms. A brief conclusion is provided in Section The packet classification problem The header fields used in packet classification are usually the source IP address, the destination IP address, the source port number, the destination port number, and the protocol field. One of the difficulties in packet classification is due to the fact that the search methods are different depending on the header type. The IP address fields require a prefix match, the port numbers require a range match, and the protocol field requires an exact match. An input packet can match multiple rules. All of the matching rules are returned when using multi-match packet classification; the best matching rule (BMR) with the highest priority is returned when using single-match packet classification. Packet classification problem can be formally defined as follows [11]. Let R ¼fR 1 ; R 2 ;...; R N g be a given set of rules, for i =1,..., N, where each rule R i consists of three entities: (1) A regular expression R i [j] for j =1,..., D, on each of D header fields, (2) A priority number, p(r i ), indicating the priority of each rule in the set, where a smaller number indicates a higher priority, and (3) An action, referred to as action(r i ). An incoming packet P matches rule R i if all the header fields P[j], for j =1,..., D, of the packet match the corresponding fields of R i [j]. Let MðPÞ be the set of rules in R that P matches, then MðPÞ ¼fR i 2 Rj P matches R i }. The D-dimensional packet classification problem is to find the best matching rule (BMR) R k in MðPÞ such that p(r k )<p(r i ) for all R i, k 2 MðPÞ, i k. In other words, the packet classification problem is to find the BMR, which is the matching rule with the highest priority. Once the BMR R k is determined, the input packet is treated as specified by the action(r k ). Table 1 shows an example rule set with 15 rules that is referred to as the class-bench database [26]. A smaller rule number is assumed to indicate a higher priority. The first two fields are related to source and destination prefixes, and they require prefix match operation. The next two fields are related to source and destination port ranges (or numbers), which require range match, representing the start and the end of the range. The last field is related to a protocol type, and it requires exact match. For example, an input packet of (110100,110000,53,25,4) has the rule R 4 as the BMR, and the packet is treated according to the action specified by R 4. The action field is omitted in Table 1 for simplicity. This example set will be consistently used in describing each hierarchical algorithm including our proposed algorithm. 3. Related works 3.1. The hierarchical trie (H-trie) The effectiveness of the hierarchical approach is a result of the diversity of flows related to IP prefix fields is much greater than that of other fields [12]. The hierarchical trie [11] firstly builds a source prefix trie, where each node of the source trie hierarchically connects to the destination prefix trie, which is composed of rules with the same

3 3012 H. Lim et al. / Computer Networks 56 (2012) Table 1 Example rule set. Rule no. Source prefix Destination prefix Source port Destination port Protocol R , , 25 6 R , , R , , R , , R , 53 25, 25 4 R , , R , , R , 53 25, 25 6 R , , R , , R , , R , 67 25, 25 4 R , , R , , R , , nodes to visit in the source trie. For the example of an input packet with header fields (110100, , 53, 25, 4), the number of visited nodes in the source trie is 7. The number of destination tries visited is 4, which are the destination tries of,1, 1101, and , and the number of visited nodes in the destination trie is 9. Hence, the total number of visited nodes is 16 for this input. In the hierarchical trie, the search complexity depends on the number of tries visited, and the memory requirement depends on the number of nodes. Let D be the number of fields, N be the number of rules in a classifier, and W be the maximum length of prefixes. The search complexity of the hierarchical approach is O(W d ) and the memory requirement is O(NdW). Back-tracking of the hierarchical trie causes an excessive number of memory accesses. Moreover, the hierarchical trie has many empty internal nodes which are not associated with a prefix or a rule. The empty internal nodes not only deteriorate the search performance by causing unnecessary memory accesses but also increase the memory overhead by causing empty entries. Fig Field hierarchical trie. source prefix. Fig. 1 shows a 2-field hierarchical trie built for the example rule set in Table 1. In this context, the trie represents a tree data structure, in which each edge corresponds to a bit representation. For example, the left edge represents a value of 0 and the right edge represents a value of 1. The first trie is composed of distinct source prefixes in Table 1. Each black node represents a node associated with a source prefix, and the node connects to a second trie by a pointer shown as a dotted line. Rules with the same source-destination prefix pair are mapped to the same node of the destination trie by a linked-list in the order of decreasing priority. Searching in the hierarchical trie is sequentially performed in each trie. For each matching node in the source trie, the search continues to the hierarchically connected destination trie. After the completion at the destination trie, the search goes back to the node where the destination field search was started. This is called back-tracking, and this process is repeated until there are no more child 3.2. The hierarchical set-pruning trie Set-pruning [11] replicates rules included in an ancestor node in a source trie into the destination trie of a descendent node to avoid back-tracking. For example, the root node of the source trie in Fig. 1 is the ancestor of all other nodes and the node 1 is the ancestor of nodes 1101, 111, and , etc. Fig. 2 shows a hierarchical set-pruning trie corresponding to the hierarchical trie of Fig. 1. The source trie is the same as in the hierarchical trie. The rules copied from the ancestors tries are represented by gray-colored nodes. As shown, every rule included in the root of the source trie is copied into all of the destination tries. Rules included in other ancestor nodes are also copied into the corresponding destination trie of the descendent nodes. Through the set-pruning, all possible matching candidates are gathered into the destination trie of the longest matching node in the source trie. Hence, a search in the source trie only needs to determine the longest matching

4 H. Lim et al. / Computer Networks 56 (2012) Fig. 2. Hierarchical set-pruning trie. node and then proceed to the destination trie connected to it. Therefore, back-tracking is avoided. For the same example packet (110100,110000,53,25,4), the number of destination trie nodes visited for this input is 3, and hence the total number of visited nodes is 10, while it was 16 for the H-trie. Search performance is improved from O(W d ) (of the hierarchical trie) to O(dW) at a cost of increasing the memory requirement. The memory requirement of the set-pruning approach is O(N d ) in the worst case The grid-of-tries While the hierarchical tries pay either a large cost in time by back-tracking or a large cost in memory by setpruning, a grid-of-tries [14] avoids both by using pre-computation. The grid-of-tries for the same example is shown in Fig. 3. Comparing the grid-of-tries with the hierarchical trie, the grid-of-tries pre-computes a switch pointer for each failure point of the destination trie, which is used for jumping directly to a next-level node of the direct ancestor s destination trie. For example, in the source trie of the hierarchical trie, the node is the ancestor of the node 00. The root of the destination trie of the source node 00 does not have a child to the right, and hence it has a switch pointer labeled as 1, which goes to a node in the next level of the destination trie of the ancestor node as in Fig. 3. The search procedure for the grid-of-tries is as follows. First the longest matching node is searched in the source trie. In the destination trie of the longest matching source node, if there is no edge to follow, the search follows the pre-computed switch pointer that directs the search to the next level of the destination trie of the direct ancestor node. The grid-of-tries skips over all filters in the next Fig. 3. Grid-of-tries. ancestor destination trie whose destination fields are shorter than the current destination match. For example, for the same input, (110100,110000,53,25,4), rule R 4 is not traversed in the grid-of-tries, while the rule is traversed in the hierarchical trie and the hierarchical setpruning trie. The grid-of-tries suggests using the pre-computation of the highest priority rule in each node of the destination trie. For example, the node of (110100,1 )in Fig. 3 would store information about R 4 since it is the highest priority rule corresponding to the node. In the

5 3014 H. Lim et al. / Computer Networks 56 (2012) Fig. 4. The proposed HSP-BST for the rule set in Table 1. Fig. 5. The data structure of the source tree. simulation section, the number of input packets that fail to get the best matching rule when the pre-computation of the highest priority rule was not carried out will be shown. For the example input, only the destination trie of source node is visited. Hence the number of visited nodes in the destination trie is just 3, and the total number of visited nodes is 10, which is the same as in the set-pruning trie. The basic grid-of-tries provides O(W d 1 ) search time with an O(NdW) memory requirement by pre-computing the switch pointers. Recently, a new hierarchical packet classification algorithm using hybrid hierarchy was proposed [15]. In this approach, the source-trie is replaced by an on-chip Bloom filter. A destination trie is composed of rules sharing the same Bloom filter index regarding the source prefix field. In order to remove the empty internal node in destination tries, the approach adopts the concept of a rule-priority trie, in which each empty internal node is replaced with the highest priority rule included in the sub-trie rooted by the empty node [2]. For the source address of a given input packet, the on-chip Bloom filter is repeatedly accessed for every distinct length to determine whether it has the source prefix with the specific length in the rule set. The uniqueness of the algorithm is that the back-tracking in the hierarchical approach is replaced by on-chip Bloom filter accesses. Algorithms described in this section require either back-tracking or empty nodes or both. The grid-of-tries not only includes empty internal nodes but also requires complicated pre-computation. 4. The proposed packet classification algorithms 4.1. Building a hierarchical set-pruning binary search tree The proposed hierarchical set-pruning binary search tree (HSP-BST) algorithm combines the binary search algorithm [7] with the hierarchical set-pruning algorithm [11]. Empty internal nodes in the trie structure are avoided by applying the binary search algorithm and back-tracking is avoided by the set-pruning. The binary search tree (BST) was studied to perform the binary search for IP address lookup by Yazdani and Min [7]. For binary search, IP prefixes should be sorted in magnitude order even though they have various lengths. The BST algorithm provides a set of new definitions in comparing the magnitudes of different length prefixes. In comparing two prefixes with different lengths, the shorter-length prefix is compared with the same-length substring of the longer-length prefix. The prefix with bigger (smaller) numerical value is denoted as bigger (smaller). If they are the same, the next bit of the longer-length prefix is examined. If it is one, the longer-length prefix is bigger, otherwise, the shorter-length prefix is bigger. For example, considering prefixes 00 and 010, prefix 010 is bigger than prefix 00 since the first two bits of

6 H. Lim et al. / Computer Networks 56 (2012) Fig. 6. The data structure of the destination tree. prefix 010 is bigger than prefix 00. For two prefixes 1 and 1101, prefix 1101 is bigger than prefix 1, since the first bit of two prefixes are the same and the second bit of prefix 1101 is 1. However, binary search cannot be directly applied to the list sorted by this definition because of prefix nesting, which is that a prefix becomes the sub-string of another prefix. For example, prefix 1 is nested in prefix For a proper binary search, the BST algorithm provides a restriction in constructing the binary search tree. The restriction is that a shorter-length prefix is compared earlier than a longer-length prefix if two prefixes are in a prefix nesting relationship. In other words, the BST algorithm enforces that an ancestor prefix be located at a higher level than a descendent prefix so that the ancestor is compared earlier. Fig. 4 shows the proposed HSP-BST. The first tree is the binary search tree version of the first trie of Fig. 1 through Fig. 3. The destination trees are the binary search tree version of the destination tries of hierarchical set-pruning tries shown in Fig. 2. Each node of the source prefix tree has a pointer to a destination prefix tree, and each destination tree consists of the rules with the same source prefix in the pruned set. Compared with the hierarchical set-pruning trie in Fig. 2, the proposed HSP-BST does not include empty nodes. For the same example packet (110100, , 53, 25, 4), the nodes of the source tree visited for this input are,1, 1101, and The destination trie of source is visited, and the nodes visited in this trie are 01,1, and 11. Hence the total number of visited nodes is just 7. The search complexity is O(dlogN), replacing W with logn, and the memory requirement is O(N d ), which is the same as the hierarchical set-pruning trie, in the worst case HSP-BST table structure The 2-field packet classification table of the proposed hierarchical set-pruning binary search tree (HSP-BST) is composed of two tables: one for the source tree and the other for the destination trees. Data structures of the source and the destination tree tables are shown in Figs. 5 and 6, respectively. The data structure of the destination table includes all the rule fields except the source prefix field. The entry valid bit is set when a rule is stored in the entry and reset when the entry is deleted. Once the valid bit is reset, the child pointers and the linked list pointers (if any) are used to continue the search and all other fields are not compared with the input. In case that the protocol field is wild, the protocol wild bit is set. The linked-list pointer is for rules having the same source-destination prefix pair. Rules are connected in the decreasing order of their priorities by the linked-list The search procedure The search procedure for the proposed algorithm is summarized in the following pseudo-code for the case that two prefix fields are used in building the hierarchical trie structure. Search (P) { BMR = N 1; // the lowest priority number root = root node of the source tree; longestpfx_nextptr = F1_Search(P.srcAddr, root); BMR = F2_Search(BMR, P, longestpfx_nextptr); } F1_Search (P.srcAddr, ptr){ curnode = ptr; if (P.srcAddr match curnode.srcpfx) longestpfx_nextptr = curnode.nexttreeptr; if (P.srcAddr > curnode.srcpfx) ptr = curnode.rightptr; else ptr = curnode.leftptr; if (ptr 1) longestpfx_nextptr = F1_Search(P.srcAddr, ptr); else return longestptr_nextptr; } F2_Search(BMR, P, ptr) { curnode = ptr; if ((BMR > curnode.ruleno) && (all fields of P match all field of curnode)) BMR = curnode.ruleno; else if ((P.dstAddr match curnode.dstpfx) && (other fields not match) && (linked list exist)) BMR = F2_Search(BMR, P, curnode.linkedlistptr); if (P.dstAddr > curnode.dstpfx) ptr = curnode.rightptr; else ptr = curnode.leftptr; if (ptr 1) BMR = F2_Search(BMR, P, ptr); else return BMR; } For incoming packet P, the longest matching prefix of the source tree table is searched first as in the hierarchical set-pruning trie. The incoming source address is compared with the source prefix stored in the node. If the input source address matches the stored source prefix, the next tree pointer is remembered. If the input address is bigger than the stored prefix, the search follows the right pointer;

7 3016 H. Lim et al. / Computer Networks 56 (2012) otherwise, the search follows the left pointer. If there are no more nodes, the search in the source tree table is over and the search moves to the destination tree table using the currently tracked next tree pointer. The current best matching rule (BMR) is initially set as the lowest priority number. For the search in the destination tree table, if the rule stored in the node has higher priority than the current BMR, the multiple header fields of the incoming packet are compared with the stored rule. If the input matches in all the fields of the stored rule, the rule number is remembered as the current BMR. If the destination address of the incoming packet matches the stored prefix, but the remaining fields do not match, the linked-list pointer is examined, and if it exists, the search follows the linked-list pointer. The search follows the right pointer if the input is bigger than the stored prefix, and follows the left pointer otherwise, until there are no nodes left. 5. The refinement techniques 5.1. Rule set characteristics Depending on the characteristics of rule sets, there are several ways to improve the proposed algorithm. Several rule sets with different types have been generated using the class-bench database [26], which is known to accurately model the characteristics of real rule sets. The generated rule sets are access control list (acl), IP chain (ipc), and firewall (fw), with sizes of 1000 rules and 5000 rules. Rule sets are named using the type of a set followed by the size such as acl1k, which is an acl type set with about 1000 rules. In generating rule sets, an example parameter setting (smoothness = 2, address scope = 0.5, and port scope = 0.1) shown in the class-bench site is used. We first found out the characteristics of each rule set related to the distribution of rules with respect to the source prefix length. For the acl, most of the rules have longlength source prefixes. However, the fw and the ipc sets have relatively even distribution and many rules in zerolength (wildcard) or short-length source prefixes. If a rule set has many rules with the wildcard source prefix, since the wildcard node is an ancestor of every node, those rules should be copied into all the destination trees in the setpruning process. This will cause an excessive number of copied rules and hence an increased amount of required memory. The second characteristic is that the priority of wildcard source prefix rules is low in general. For the acl sets, no wildcard rule is included in the top 80% rank in priority. For the ipc and fw sets, no wildcard rule is included in the top 60% rank in priority. If the search against the non-wildcard rules is done first, the search will be more efficient since it will avoid searching against relatively low priority wildcard rules Controlled rule copy Based on these two characteristics, a technique refining the proposed HSP-BST is to construct two separate trees: one for rules with non-wildcard source prefixes (main tree) and the other for rules with wildcard source prefixes (wildcard tree). The wildcard tree is searched only if needed. This technique is denoted as a controlled rule copy. A threshold is defined as the highest priority number in the wildcard tree. For the wildcard rules, a one-dimensional BST using the destination prefix field is built, and the priority number of the highest priority rule is recorded as the threshold. The number of nesting levels in the source prefix field is 3 or 4 for the rule sets. Table 2 shows the number of rules after set-pruning, the number of rules after the controlled rule copy, and the threshold value of the wildcard tree. As shown, even though the number of nesting levels is limited to a small number, the number of rules replicated by the set-pruning is excessive. It is shown that the number of replicated rules is significantly reduced by the proposed controlled rule copy. The acl sets have big threshold values, which means the priority of the highest priority rule included in the wildcard tree is very low. Other sets have moderate threshold values. The refined structure of the proposed HSP-BST is shown in Fig. 7. The search procedure of the controlled rule copy refinement is as follows. The local BMR is determined by the search of the main tree, which is the same as the search procedure in the HSP-BST. The priority of the local BMR is compared with the threshold. If the local BMR has a higher priority than the threshold, there is no need to search the wildcard tree and the local BMR is the final BMR. However, if the local BMR has a lower priority than the threshold, the search is continued at the wildcard tree. Comparison of the input with the stored rule in the wildcard tree is performed only when the stored rule has a higher priority than the local BMR. For the same example packet (110100, , 53, 25, 4), the local BMR resulted from non-wildcard HSP-BST search is R 4. Since the local BMR has a lower priority than the threshold value of the wildcard tree, the search is continued at the wildcard tree. The total number of visited nodes is 10, which are 4 at the source tree of the non-wildcard HSP-BST, Table 2 Characteristics of rule sets. Rule set No. of rules No. of rules after set pruning No. of rules after controlled rule copy Threshold acl1k acl5k ipc1k ipc5k fw1k fw5k

8 H. Lim et al. / Computer Networks 56 (2012) Fig. 7. The proposed refinement using controlled rule copy. Fig. 8. The proposed refinement using ancestor tree pointers. 3 at the destination tree of source , and 3 at the wildcard tree Complete removal of rule copy The set-pruning of rules avoids back-tracking, but consumes a large amount of memory space. We propose a refinement technique using a pre-computed ancestor tree pointer to avoid the set-pruning. Since rules with more specific prefixes generally have higher priorities, if a matching rule with the most specific prefixes is identified first, it is more likely that the rule is the best matching rule, and hence the tree search can be avoided for most of the inputs by just comparing with the highest priority number of each destination tree. The ancestor tree pointer is defined as a pointer to the destination tree of its direct ancestor in the source prefix field. The ancestor tree pointer is stored in each destination tree. Fig. 8 shows the proposed refinement using ancestor tree pointers that completely removes the rule copy. In Fig. 8, for the source tree, since the root node is the direct ancestor of a prefix 00, the destination tree of source prefix 00 has a pointer to the destination tree of the root node. Similarly, the destination tree of source prefix 010 has a pointer to the destination tree of the root node. Ancestor tree pointers consecutively connect the destination trees of , 1101,1, and the root node. Ancestor tree pointers also consecutively connect the destination trees of 111,1, and the root node, and so on. Fig. 8 also shows a pre-computed threshold value inside the parenthesis at the root node of each destination tree.

9 3018 H. Lim et al. / Computer Networks 56 (2012) Table 3 Comparison of each hierarchical trie or tree for the rule set in Table 1 for an input packet of (110100, ,53, 25,4). Trie/tree No. of nodes No. of stored rules Pre-computed pointers No. of accesses Src Dst Src Dst H-trie Set-pruning trie Grid-of-tries HSP-BST-bas HSP-BST-ref HSP-BST-anc The threshold value is stored in each destination tree so that search can be avoided if the current BMR has a higher priority than the threshold value. The pre-computation required in the proposed refinement technique is much simpler than that of the grid-of-tries. Each destination tree has a single pre-computed pointer and a single threshold value in the proposed refinement technique, while the grid-oftries should pre-compute a pointer in every failure node of the destination trie and the best matching rule in each node of the destination trie. In search, the BMR is initially set as the lowest priority. The longest matching source prefix is determined from the source tree, and the search moves to the destination tree of the longest matching source prefix. The current BMR is monitored. The destination tree of the direct ancestor of the longest matching source prefix is searched next if its threshold value has a higher priority than the current BMR. This process is repeated until there are no more trees to search. If longer prefixes are assumed to have higher priorities as assumed in the grid-of-tries, many destination tree searches are avoided by the threshold comparison since the current BMR is primarily produced by the destination tree of the longest matching source prefix. In this way, the pre-computation of the best matching rule in each node of the destination tries in the grid-of-tries is avoided. For the same example packet (110100, , 53, 25, 4), there is no current best matching rule at the destination tree of source Since the ancestor pointer points to the destination tree of source 1101, search goes to the tree, and there is no match in the tree. The search goes to the destination tree of source 1 and finds the match R 4. After remembering R 4 as the current BMR, the search goes to the destination tree of the root of the source tree. Since the threshold value of the tree has a higher priority than the current BMR R 4, a search is performed. The total number of visited nodes is 10, which are 4 at the source tree, 1 each at the destination trees of , 1101, and 1, and 3 at the destination tree of the root of the source tree. The search complexity becomes O((logN) d ), but it is much better in most real cases as will be shown through simulation. The memory requirement is O(Nd). Table 3 shows the number of nodes for each trie or tree and shows the number of node accesses for the example packet. In this table, HSP-BST-bas, HSP-BST-ref, and HSP- BST-anc refer the proposed hierarchical set-pruning binary search tree, the controlled rule copy refinement, and the ancestor tree pointer refinement, respectively. It is shown that the proposed HSP-BST-bas provides the best search performance while the HSP-BST-anc provides the smallest memory requirement. 6. Simulation results and performance analysis The asymptotic analysis of search complexity and storage requirement is a useful metric. However, since packet classification algorithms are mostly based on heuristics, different rule sets with different structures give very different performance results. Extensive simulations using C- language for various algorithms were performed with the databases as described in the previous section. The number of input traces used in simulation is about 3 times the number of rules. The search speed is evaluated using the average number of memory accesses and the maximum number of memory accesses. Here the number of memory accesses is counted for the number of node accesses for the source and the destination tries or trees and the number of memory accesses in the linked list if memory entries in the linked list are visited. The performance of HSP-BST-bas, HSP-BST-ref, and HSP-BST-anc are compared with the hierarchical trie (H- Trie), the hierarchical set-pruning trie, the grid-of-tries, and the hybrid hierarchy using Bloom filter (BF-RPT) [15]. Note that the grid-of-tries requires the complicated pre-computation of the switch pointers and the best matching rule in each node of the destination tries. It would be meaningful to determine the number of failure cases, which do not return the correct best matching rules for given input packets, when the pre-computation of the best matching rule in each node was not performed. The number of failures was 3, 19, 2, 76, 27, and 20, for acl1k, acl5k, ipc1k, ipc5k, fw1k, and fw5k, respectively. The performance comparisons in terms of the average number of memory accesses are shown in Figs. 9 and 10 for 1000 and 5000 rules, respectively. In the average number of memory accesses, the proposed HSP-BST and the two proposed refinement techniques show similar performance. Note that the proposed refinement techniques were intended to reduce the memory overhead of the proposed HSP-BST caused by the set-pruning even though the search performance may be sacrificed. However, the results in the average search performance did not degrade much in the refined structures. This implies that using threshold values in two refinement techniques is effective. Comparing Figs. 9 and Fig. 10, it is shown that the average numbers of memory accesses of the proposed algorithms do not change much for large rule sets, and hence the

10 H. Lim et al. / Computer Networks 56 (2012) Fig. 9. Average number of memory accesses for 1K rule sets. Fig. 10. Average number of memory accesses for 5K rule sets. proposed algorithms have very good scalability. The figures clearly show that the proposed algorithms have significantly improved the search performance compared to the hierarchical trie, the hierarchical set-pruning trie, and the grid-of-tries by avoiding either the access to empty nodes or the back-tracking or both. The hybrid hierarchy algorithm (BF-RPT) shows different performance depending on the size and the type of rule sets. For the maximum number of memory accesses shown in Figs. 11 and 12, the figures show that the HSP-BST has much better performance than the other algorithms and slightly better performance than the two proposed refinement techniques. The reason is that there are two or more separate trees to be sequentially searched in the proposed refinement techniques in the worst case. The memory requirements are shown in Figs. 13 and 14. The figures show that the required memory amount is reduced to percent by the controlled rule copy. The proposed refinement using ancestor tree pointers requires the smallest memory amount for every rule set. While the H-trie, the hierarchical set-pruning, and the grid-of-tries have large variance depending on the characteristics of

11 3020 H. Lim et al. / Computer Networks 56 (2012) Fig. 11. Maximum number of memory accesses for 1K rule sets. Fig. 12. Maximum number of memory accesses for 5K rule sets. the rule sets, the proposed refinement techniques show consistent performance in the requirement memory size. It is shown that the memory requirements of the proposed algorithms are less than 350 Kbyte for every case, and hence the packet classification tables of the proposed algorithms can be easily embedded in a chip. 7. Concluding remarks Hierarchical approaches to packet classification are known to be very effective since the search space is significantly reduced when a field search is completed. However, previous hierarchical approaches have problems of either empty internal nodes or back-tracking, or both. In this paper, an efficient hierarchical packet classification algorithm is proposed by applying binary search to the pruned set of rules. The empty internal node problem is solved by applying the binary search tree, and the backtracking problem is solved by applying set-pruning, in our proposed approach. In order to reduce the memory overhead caused by the set-pruning in our approach, a controlled rule copy technique is proposed. The controlled rule copy technique

12 H. Lim et al. / Computer Networks 56 (2012) Fig. 13. Memory requirement for 1K rule sets (Kbyte). Fig. 14. Memory requirement for 5K rule sets (Kbyte). utilizes a characteristic of rule sets, in which rules with a wildcard generally have lower priorities. By separating a tree for rules with a wildcard in the source field, the number of replicated rules caused from the set-pruning is significantly reduced. To remove the rule copy completely, a technique using ancestor tree pointers is proposed. The ancestor tree pointer technique utilizes a characteristic of rule sets, in which rules with the most specific prefixes generally have higher priorities. Once a current best matching rule with the most specific prefixes is identified, most of the destination tree searches are avoided by just comparing the priority of the current BMR with the thresholds of destination trees. The simulation results show that the proposed algorithms provide a packet classification with an average of memory accesses for about 5000 rules with less than 350 Kbyte of memory space. Acknowledgements This work was supported by the National Research Foundation of Korea (NRF) grant funded by the Korea

13 3022 H. Lim et al. / Computer Networks 56 (2012) government (MEST) ( ). This research was also supported by the MKE (The Ministry of Knowledge Economy), Korea, under the HNRC-ITRC support program supervised by the NIPA (2012-H ). References [1] H.J. Chao, Next generation routers, Proceedings of the IEEE 90 (9) (2002) [2] H. Lim, C. Yim, E.E. Swartzlander Jr, Priority tries for IP address lookup, IEEE Transactions on Computers 59 (6) (2010) [3] H. Park, H. Hong, S. Kang, An efficient IP address lookup algorithm based on a small balanced tree using entry reduction, Computer Networks 56 (1) (2012) [4] H. Lim, H. Kim, C. Yim, IP address lookup for Internet routers using balanced binary search with prefix vector, IEEE Transactions on Communications 57 (3) (2009) [5] S. Dharmapurikar, P. Krishamurthy, D.E. Taylor, Longest prefix matching using bloom filters, IEEE/ACM Transactions on Networking 14 (2) (2006) [6] M. Waldvogel, G. Varghese, J. Turner, B. Plattner, Scalable high speed IP routing lookups, in: Proc. ACM SIGCOMM, 1997, pp [7] N. Yazdani, P.S. Min, Fast and scalable schemes for the IP address lookup problem, in: Proc. IEEE HPSR, September 2000, pp [8] David E. Taylor, Survey and taxonomy of packet classification techniques, ACM Computing Surveys 37 (3) (2005) [9] C.-N. Lu, C.-Y. Huang, Y.-D. Lin, Y.-C. Lai, Session level flow classification by packet size distribution and session grouping, Computer Networks 56 (1) (2012) [10] F. Baboescu, P. Warkhede, S. Suri, G. Varghese, Fast packet classification for two-dimensional conflict-free filters, Computer Networks 50 (11) (2006) [11] P. Gupta, N. McKeown, Algorithms for packet classification, IEEE Network 15 (2) (2001) [12] F. Baboescu, S. Singh, G. Varghese, Packet classification for core router: is there an alternative to CAMs?, in: Proc. IEEE INFOCOM, vol. 1, 2003, pp [13] P.-C. Wang, Scalable packet classification with controlled crossproducting, Computer Networks 53 (6) (2009) [14] V. Srinivasan, G. Varghese, S. Suri, M. Waldvogel, Fast and scalable layer four switching, in: Proc. ACM SIGCOMM, 1998, pp [15] A.G. Priya, H. Lim, Hierarchical packet classification using a bloom filter and rule-priority tries, Computer Communications 33 (10) (2010) [16] H. Lim, M. Kang, C. Yim, Two-dimensional packet classification algorithm using a quad-tree, Computer Communications 30 (6) (2007) [17] H. Lim, J.H. Mun, High-speed packet classification using binary search on length, in: Proc. of ANCS, 2007, pp [18] F. Baboescu, G. Varghese, Scalable packet classification, IEEE/ACM Transactions on Networking 13 (1) (2005) [19] P. Gupta, N. Mckeown, Classification using hierarchical intelligent cuttings, IEEE Micro 20 (1) (2000) [20] S. Singh, F. Baboescu, G. Varghese, J. Wang, Packet classification using multidimensional cutting, in: Proc. of. SIGCOMM, [21] V. Srinivasan, S. Suri, G. Varghese, Packet classification using tuple space search, ACM SIGCOMM Computer Communication Review 29 (4) (1999) [22] H. Lim, S. Kim, Tuple pruning using bloom filters for packet classification, IEEE Micro 30 (3) (2010) [23] K. Lakshminarayanan, A. Rangarajan, S. Venkatachary, Algorithms for advanced packet classification with ternary CAMs, in: Proc. ACM SIGCOMM, 2005, pp [24] A.X. Liu, C.R. Meiners, E. Torng, TCAM razor: a systematic approach towards minimizing packet classifiers in TCAMs, IEEE/ACM Transactions on Networking 18 (2) (2010) [25] M. Faezipour, M. Nourani, Wire-speed TCAM-based architectures for multimatch packet classification, IEEE Transactions on Computers 58 (1) (2009) [26] D.E. Taylor, J.S. Turner, Classbench: a packet classification benchmark, IEEE/ACM Transactions on Networking 15 (3) (2007) Hyesook Lim received the B.S. and the M.S. degrees at the Department of Control and Instrumentation Engineering in Seoul National University, Seoul, Korea, in 1986 and 1991, respectively. She got the Ph.D. degree at the Electrical and Computer Engineering from the University of Texas at Austin, Texas, in From 1996 to 2000, she had been employed as a member of technical staff at Bell Labs in Lucent Technologies, Murray Hill, NJ. From 2000 to 2002, she had worked as a hardware engineer for Cisco Systems, San Jose, CA. She is currently a professor in the Department of Electronics Engineering, Ewha Womans University, Seoul, Korea, where she does research on router design issues such as IP address lookup, packet classification, and deep packet inspection and on hardware implementation of various network protocols such as TCP/IP and Mobile IPv6. Soohyun Lee received the B.S. and the M.S. degree in Electronics Engineering from Ewha Womans University, Seoul, Korea. From 2009, she worked at Pantech Mobile, Seoul, Korea. Her research interests are layer 2 and layer 3 architectures, fast packet classification, and wireless networks. Earl E. Swartzlander, Jr. received the B.S. degree from Purdue University in 1967, the M.S. degree from the University of Colorado in 1969, and the Ph.D. degree from the University of Southern California in 1972, all in electrical engineering. He is a professor of electrical and computer engineering at the University of Texas at Austin. In his current position, he and his students conduct research in computer engineering with emphasis on application-specific processor design, including high-speed computer arithmetic, embedded processor architecture, VLSI technology, and nanotechnology. As of May 2011, he has supervised 35 Ph.D. students. From 1975 to 1990, he held a variety of positions at TRW including the director of Independent Research and Development in the TRW Defense Systems Group, the manager of the Digital Processing Laboratory in the Electronics and Technology Division, and the manager of the Advanced Development Office in the System Development Division. He was the editor-in-chief of the IEEE Transactions on Computers from 1990 to 1994 and was the founding editor-in-chief of the Journal of VLSI Signal Processing. In addition, he has served as an associate editor for the IEEE Transactions on Computers, the IEEE Transactions on Parallel and Distributed Systems, and the IEEE Journal of Solid-State Circuits. He has been a member of the Board of Governors of the IEEE Computer Society ( ), the IEEE Signal Processing Society ( ), and the IEEE Solid-State Circuits Council/Society ( ). He has been a member of the IEEE History Committee ( ), the IEEE Fellows Committee ( ), and the IEEE James H. Mulligan, Jr., Education Medal Committee ( ). He has chaired a number of conferences. He is the author of one book, editor of seven books and the author or coauthor of 70 refereed journal papers, 33 book chapters, and 279 conference papers. He is a fellow of the IEEE. He has been honored with the IEEE Third Millennium Medal, the Distinguished Engineering Alumnus Award from the University of Colorado, the Outstanding Electrical Engineer and Distinguished Engineering Alumnus Awards from Purdue University, and the IEEE Computer Society Golden Core Award.