Hashing Functions Performance in Packet Classification

Transcription

1 Hashig Fuctios Performace i Packet Classificatio Mahmood Ahmadi ad Stepha Wog Computer Egieerig Laboratory Faculty of Electrical Egieerig, Mathematics ad Computer Sciece Delft Uiversity of Techology {mahmadi, stepha}@ce.et.tudelft.l Abstract Packet classificatio remais a importat aspect of etwork processig as it ecompasses icreasigly more fuctioality due to ewly itroduced services. Essetially, it etails the matchig of icomig packets agaist a database of rules performig the operatio that is associated with the matchig rule with the highest priority. Withi the hashigbased packet classificatio algorithms, the tuple space search algorithm is gaiig much iterest. Usig tuple spaces, the rules ca ow be subdivided ito sets ad i tur these sets ca be searched i parallel. Withi each set, the hashig fuctios determie the locatio of storig the rules. However, depedig o the chose collectio of hashig fuctios, rules (withi a set) ca be mapped to the same locatio (cotaiig multiple buckets to store the rules) resultig i a collisio. A side-effect of such collisios is that more memory accesses are eeded to resolve the collisio resultig i degraded performace. I this paper, we compare ad evaluate differet hashig fuctios takig from the H3 class of hashig fuctios usig which collisios ca be reduced ad i tur reduce the average bucket sizes. Our results show that whe usig the H3 class of hashig fuctios, we were able to reduce the umber of collisios by at least 7% ad by at most 49% whe compared to other hashig fuctios. Keywords: Packet classificatio, tuple space, uiversal hashig fuctio, collisio I. INTRODUCTION Traditioally, packet classificatio etailed the forwardig of packets solely based o the destiatio address that is specified i oe of the may header fields withi a packet. However, the importace of packet classificatio has icreased greatly with the itroductio of services like Quality of Service (QoS), virtual private etwork (VPN), policy-based routig, traffic shapig, firewalls, ad etwork security. Additioal criteria had to be satisfied by takig ito accout additioal header fields from the packet, such as, source address, protocol type, source ad destiatio port umbers (see Figure 1). Packet classificatio ca be see as the categorizatio of icomig packets based o their headers accordig to specific criteria that examie specific fields withi a packet header. The criteria are comprised of a set of rules that specify the cotet of specific packet header fields to result i a match [3][4][9]. Traditioally, hashig is utilized i packet classificatio to speed up the process of determiig whether a icomig packet matches a certai rule (that i tur determie the actio to take o the packet). Furthermore, certai rules oly examie specific fields (sometimes eve oly the prefix) of the packet headers specified usig a tuple. Cosequetly, rules that examie the same fields (or the prefix) are combied i a so-called tuple space with all those rules hashed ito a hash table. Summarizig, the (prefix of) headers of icomig packets are selected for each tuple (the umber of tuples depeds o the rule set) ad hashed to determie whether it matches a rule withi that particular tuple space stored i the hash table. A commo problem i usig hashig is collisio, i.e., the mappig of rules i the hash table ca be to the same hash table locatio. Cosequetly, whe a icomig packet is hashed to a hash table etry cotaiig multiple rules it must be matched to all these rules resultig i much loger processig time. Therefore, the choice of hashig fuctios will have a certai impact o the umber of collisios. I literature, hashig fuctios such as belogig to the H3 class have bee evaluated for radom data by radom selectio of hashig fuctios [6]. As metioed before, rules ca be categorized i the tuple-space after which hashig fuctios are used to determie the storage locatio of these rules. I this paper, we propose to utilize the H3 class of hashig fuctios to decrease the umber of metioed collisios ad to desig a adaptive software packet classifier. I particular, we derive a hashig fuctio through the H3 class of hashig fuctios i order to demostrate its effect o the umber of collisios ad the average bucket size. More specifically, we ivestigate several well-kow hashig fuctios to determie the umber of collisios ad show that the umber of collisios ca be further reduced by at least 7% ad by at most 49% for real rule-set databases by utilizig class H3 hashig fuctios. It also decreases the average bucket size (a buffer that stores multiple rules) i compared to other hashig fuctios. The paper is orgaized as follows: Sectio II describes related work. Sectios III represets the tuple space algorithms for packet classificatio, the defiitio of the class H3 hashig fuctios, ad packet classifier architecture. Sectio IV presets related results. Sectio V, we draw the overall coclusios. II. RELATED WORK I this sectio, we preset differet related works by others i packet classificatio algorithms that utilize hashig fuctios. I [6], the H3 class of hashig fuctios as a class of uiversal hashig fuctios with implemetatios i

2 Source port Destiatio port Protocol Source IP address Destiatio IP address 16 bits 16 bits 8 bits 32 bits 32 bits Trasport layer Network layer Fig. 1. Most importat fields that are used i classificatio algorithms hardware, are itroduced. The hashig fuctio performace usig maximum search legth that is called llps (legth of the logest prob sequece) is evaluated. The hashig fuctio selectio procedure is radom. I [9][11], a packet classificatio algorithm usig tuple space is itroduced that cocateates the ecessary umber of bits from rule-sets ad icomig packets to make a hash key. To decrease the umber of collisios, the memory size is icreased. It also assumes that the hashig fuctio is perfect ad the complexity of packet classificatio algorithm is ivestigated. I practice, to achieve a perfect hashig fuctio is difficult. I [8], a Fast Hash Table (FHT) architecture usig a Bloom filter for packet classificatio ad IP lookup is preseted. FHT icreases the memory size to several times usig a TCAM memory i order to reduce collisios ad memory access times i the hash table ad utilizes a class of uiversal hashig fuctios where the hashig fuctios are selected radomly. I our work, for each rule-set database, we fid a H3 hashig fuctio via searchig through oe thousad hashig fuctios from the H3 class of hashig fuctios. This fuctio is utilized by our software packet classifier that stores rules i a hash table. The software packet classifier decreases the umber of collisios by achievig a hashig fuctio with a miimum umber of collisios ad cosequetly improves the packet classificatio speed ad throughput. III. TUPLE SPACE PACKET CLASSIFICATION AND HASHING FUNCTIONS I this sectio, the cocept of the tuple space packet classificatio algorithm, related hashig fuctios, ad a software packet classifier are preseted. A. Tuple Space Classificatio A high level approach for multiple field search employs tuple space. A tuple defies the umber of specified bits i each field of the rule. Sriivasa, et. al. itroduced the tuple space approach ad the collectio of tuple search algorithms i [9][10][11]. We provide a example of rule-set for rule classificatio o five fields i Table I. I Table I, words eq ad gt are abbreviatios of operators represetig equal to ad greater tha a port umber i the expressed rule. Address prefixes cover 32- bit addresses ad port rages cover 16-bit port umbers, for address prefix fields, the umber of specified bits is simply the umber of o-wildcard bits i the prefix, for the protocol fields the value is simply a boolea: 1 if a Fig. 2. Nestig level (80, 80) Rage ID (0, 65535) (1024, 65535) Assigig values for rages, based o Nestig Level ad Rage-ID protocol is specified, 0 if a wildcard is specified [9][11][12]. The umber of specified bits i a port rage are ot as straightforward to defie. The authors itroduce the cocept of estig levels ad Rage-ID to defie the tuple value for port rages. The estig level specifies the layer of the hierarchy ad the Rage-IDs uiquely labels the rage withi its layer. I this way, we ca covert all port rages to a (Nestig level, Rage-ID) pair. The estig level is used as the tuple value for the rage, ad the Rage-ID is used to idetify the specific rage withi the tuple. The full rage, i this example ( ) always has the id 0. The two rages at level 1, amely (0, 1023) ad (1024, 65535) i our example receive id 0 ad 1 respectively. The example of mappig port rage to estig level ad Rage-ID for Table I is depicted i Figure 2. For example, a search key for the tuple [8, 24, 2, 0, 1] is costructed by cocateatig the first octet of the packet source address, the first three octets of the packet destiatio address, the Rage-ID of the source port, the rage at estig level 2 coverig the packet source port umber, the Rage- ID of the destiatio port, rage at estig level 0 coverig the packet destiatio port umber, ad the protocol field. All algorithms employig the tuple space approach ivolve a search i the complete tuple space or a subset thereof. The tuple space techiques ca exploit parallelism [11]. For example rule set i Table I a search key would have to probe 5 tuple istead of searchig all 6 tuples. I practice, the use of real rule sets i tuple space search reduced the umber of searches by a factor of four to seve [9][11]. B. Hashig Fuctios Several kids of hashig fuctios are utilized i packet classificatio: additive, rotative, bit extractio, XOR-based, mixed, ad uiversal hashig fuctios [5][6]. I additive hashig fuctios, the hash value is costructed by traversig

3 Rules Destiatio IP (address Source IP (address mask) Port No. Protocol No. Tuple space mask) R * * [32, 24, 0, 0 ] ( ) ( ) R eq www tcp [24, 32, 2, 1] ( ) ( ) R gt 1023 udp [32, 24, 1, 1] ( ) ( ) R ( ) ( ) eq www udp [16, 8, 2, 1] R ( ) ( ) eq www tcp [16, 8, 2, 1] R ( ) ( ) * * [0, 0, 0, 0] TABLE I EXAMPLE RULES AND RELATED TUPLES. through the data ad cotiually icremetig a iitial value by a calculated value relative to a elemet withi the data. The calculatio performed o the elemet value is usually i the form of a multiplicatio by a prime umber. I rotative hashig fuctios, every elemet i the data strig is used to costruct the hash value, but ulike additive hashig the values are put through a process of bitwise shiftig. I the bit extractio method, the hashig fuctio etails selectig j bits out of the i bits of the key. I XOR-based hashig fuctios, the i bit key is partitioed ito j bit segmets. The segmets are exclusive-ored to produce the hash address. I the mixed method, the hashig fuctios utilize ay or all of the metioed techiques. It obvious that the performace of these fuctios depedet o the key set [5][6]. These hashig fuctios take loger to execute compared to the earlier metioed fuctios that oly utilize bitwise logical operatios. A solutio to achieve a hashig fuctio that is idepedet from the key set is by utilizig a class of uiversal hashig fuctios that exploits bitwise logical operatios i their defiitio. Let H represet a class of fuctios with iput set A ad output set B. H is said to be uiversal if for all x, y i A, o pair of distict keys collide uder more tha (1/ B )th of the fuctios where B deotes size of B [2]. A special class of uiversal hashig fuctios is called H3 hashig fuctios [2][6]. The H3 class of hashig fuctios are defied as follows: Let A = 0, 1, 2,..., 2 i 1 be the key space, B = 0, 1, 2,..., 2 j 1 be the address space, i deotes the umber of bits i i the key, j deotes the umber of bits i address, Q deotes the set of i j boolea matrices, ad I represets the give key set, I = x 1, x 2,..., x, I A. For a give q Q ad x A, let q(k) be the k th row of the matrix q ad x k be the kth bit of x. The hashig fuctio h q (x) : A B is defied as follows: h q (x) = x 1.q(1) x 2.q(2)... x i.q(i) (1) where. deotes the biary AND operatio ad the exclusive OR operatio. The hashig fuctio from this class ca be easily implemeted i hardware. The hardware stores the i j boolea matrix that ca be orgaized i a bak of registers [6] where the boolea matrices ca be geerated i software ad the loaded ito the bak of registers. Based o the tuple space represetatio for the rule-set database ad IP packets, the size of the iput key is 88 bits log (32 bit source IP address, 32 bit destiatio IP address, 8 bit Rage-ID for source port, 8 bit Rage-ID for destiatio port ad 8 bit protocol field). The maximum size of the tuple or address space is assumed to be 2 16 rules for 16 bit address. Therefore, Q deotes a set of matrices to defie the H3 class of hashig fuctios i the tuple space packet classificatio algorithm. C. Packet Classifier Architecture The tuple space packet classificatio architecture is depicted i Figure 3. Packet search Packet trace Makig hash key Packet matcher Tuple specificatio Actio Rule hash table costructor Rule database Determiig tuple Hash key Hash key m Hash tables for differet tuples 1 B H3 best H3 hashig fuctio selector Fig. 3. The architecture of packet classifier with optimized hashig fuctios i tuple space. The architecture comprises two mai compoets: rules hash table costructor ad the packet search uit. The hash table costructor reads the rules from a rule-set database ad extracts the rule specificatio to determie the correspodig tuple that the rule belogs to. After determiig the tuple, the rule should be hashed i the hash table associated with the tuple. Subsequetly, the hash key eeds to geerated utilizig the hashig fuctio after which the rules are stored i the hash table. Before geeratig the hash key, the H3 hashig fuctio selector -compoet determies the best hashig fuctio withi the H3 class of hashig fuctios. This compoet receives differet rules from the

4 rule database ad hash them usig differet hashig fuctios from class H3 (i here 1000 hashig fuctios) to derive the hashig fuctio with the miimum umber of collisios that is called H3 best. Afterwards, this hashig fuctio is utilized by the packet search compoet for the matchig of icomig packets agaist stored rules i the hash tables related to tuples. I the hash table costructio, differet hash tables with uequal sizes are created sice each hash table correspods to a sigle tuple that relates to differet rules with their ow specificatios. Usually more tha half of the rules belog to two tuples oly. This is depicted i Figure 3. I this figure, m deotes the umber of tuples ad B represets the bucket size. The packet search compoet of the packet classifier processes the icomig packets to fid the matchig rules i the hash tables correspodig to the tuple specificatios. Therefore, for each icomig packet, a hash key is extracted based o the tuple specificatio. This procedure exploits the geerated hashig fuctio by the hash table costructor. Cosequetly, m hash keys are utilized to access the m hash tables (after hashig) to determie whether matchig rules ca be foud. The importace of a hashig fuctio ca be see i this step, sice the decreasig oe access i hash table costructio step will decrease m (umber of tuples) accesses i packet search. The accessig of the hash table ca be performed i a serial or parallel maer. Fially, the actual packet is checked agaist the foud rules i the packet matcher compoet. For each packet, the umber of hashig operatios are equal to the umber of tuples i the system or the umber of distict hash tables, therefore, the umber of accesses i a sequetial search process per packet is equal to the umber of tuples. Due to the isertio of ew rules ad possible icremetal updates, the rule-set database ca evolve (chage) over time. Therefore, after the sertio of certai rules, the utilized H3 hashig fuctio is o loger desirable sice the ewly iserted rules may create collisio. I this case, we ca defie a update threshold, which is a value that whe exceeded by the umber of ewly iserted rules, causes the packet classifier to execute the hash table costructor compoet to determie a ew H3 hashig fuctio. The value of the update threshold is assumed to be the worst case of the improvemet rate of the system. I here, based o the result sectio, the update threshold is assumed to 7% of umber of rules i the rule-set database. IV. RESULTS For the system test, we utilized differet rule-set databases ad packet traces that are used by Applied Research Laboratory i Washigto Uiversity i St. Louis[7]. I the rule-set database, each rule cosists of 5 header fields icludig [Source IP address, Destiatio IP address, Source port, Destiatio port, Protocol] ad the format IP address prefix i dot-decimal otatio]/[prefix legth] [Destiatio IP address prefix i dot-decimal otatio]/[prefix legth] [Low source port] : [High source port] [Low destiatio port] : [High destiatio port] [Protocol value i hexadecimal]/[protocol mask i hexadecimal] [7]. A example of a rule i the rule-set database is /28 67 : : 67 0x11/0xff. The packet header trace format is [Source IP address i decimal] [Destiatio IP address i decimal] [Source port value i decimal] [Destiatio port value i decimal] [Protocol i decimal]. a example of a packet header i a packet trace is: The specificatios of rule-set databases, ad packet traces are show i Table II. Table II icludes seve rulesets database ad packet traces. The rule-sets FW1, ACL1 ad IPC1 were extracted from real rule-sets ad others were geerated by Classbech bechmark [7]. The results are geerated usig two differet load factors. The first load factor has the value of prime(), where is the umber of rules i the tuple ad the value of prime() represets the size of address space (tuple size). The prime() is the first prime umber that is larger tha. There is o substatial mathematical work that ca defiitely prove the relatioship betwee prime umbers ad pseudo radom umber geerators. Nevertheless, the best results have bee foud whe usig prime umbers. Geeratig prime umbers for each tuple is time cosumig ad implemetatio is ot helpful i hardware. The secod load factor which is easier to implemet i hardware is, where the size of address space i each tuple is 2 [log 2 ]+1 equal to 2 to the power of umber of bits i umber of rules i tuples. I these tables, H3 best represets a fuctio of class H3 hashig fuctios that result i miimum umber of collisios. H3 worst represets a fuctio of class H3 hashig fuctios that result i maximum umber of collisios. We utilize six geeral hashig fuctios that belog to mixed hashig fuctio type as follows: APH, DJBH, DEK, ELF, JS ad CRC [1][5]. The specificatio of metioed hashig fuctios are preseted i Table III. Table III icludes the ame ad the umber of geerated collisios for differet rule-set databases with a load factor of prime(). The fuctio APH is the best hashig fuctio amog the metioed mixed hashig fuctios. Therefore, we oly preset the results of APH hashig fuctio. The umber of geerated collisios for differet hashig fuctios usig the packet classifier is preseted i Table IV. I Table IV, we ca observe that, usig the H3 best of algorithms decreases the umber of collisios by at most 49% ad by at least 7% i compariso to APH hash fuctio for real rule-set databases. It also shows, that 2 [log 2 ]+1, costructig tuple spaces with a load factor of decreases the umber of collisios i compariso to a load factor prime(). The average bucket size for differet hashig fuctios with differet rule-set databases is preseted i Table V. The average bucket size for oempty buckets is also evaluated. Some buckets do ot iclude ay rules, therefore,

5 FW1-100 FW1-1k FW1-5k FW1-10k FW1 ACL1 IPC1 Number of rules Number of tuples Number of Packets TABLE II RULE SET DATABASE AND PACKET TRACE SPECIFICATION. they are excluded from the computatios. Based o Table V, we ca observe that H3 best has slower bucket size i compariso to H3 worst ad APH. The H3 best decreases the average bucket size by at most 9% ad by at least 1.5% i compariso to APH hashig fuctio. The umber of overflow items (these represet the items that ca ot be placed i the related bucket with specified size) i differet hashig fuctios with two differet bucket size, is preseted i Tables VI ad VII. Based o the Tables VI ad VII, we ca observe that the H3 best decreases the umber of overflow items compared to APH ad H3 worst. From the Table V, we ca observe that, the average bucket size for all of hashig fuctios is less tha 2. But the Table VI ad Table VII show that the size of some buckets is larger tha 3. It is due to the distributio of rules i the differet tuples. Our observatios show that more tha half of rules are stored i two tuples ad other tuples oly iclude a small umber of rules. I the tuple with small umber of rules, the umber of collisios are low. I the tuples with large umber of rules, the umber of collisios is more tha other tuples ad the average size of buckets is larger. Fially, utilizig H3 best decreases the average bucket size i the tuple with large umber of rules i compariso to other tuples. From Tables VI ad VII, we 2 [log 2 ]+1 ca observe that the H3 best with a load factor of geerates the lowest umber of collisios, the shortest bucket size ad the lowest umber of overflows i compariso to other hashig fuctios. 25 th IASTED Iteratioal Coferece o Parallel ad Distributed Computig ad Networks (PDCN 2007), pages 70 76, February [2] J. Lawrece Carter ad Mark N. Wegma. Uiversal Classes of Hash Fuctios. I Proceedigs of the 9th aual ACM symposium o Theory of computig, pages ACM Press, [3] P. Gupta ad N. McKeow. Algorithms for Packet Classificatio. Joural of IEEE Network, 15(2):24 32, March-April [4] T. V. Lakshma ad D. Stiliadis. High-speed Policy-based Packet Forwardig Usig Efficiet Multi-dimesioal Rage Matchig. I Proceedigs of Coferece o Applicatios, Techologies, Architectures, ad Protocols for Computer Commuicatio (ACM/SIGCOM), pages , September [5] A. Partow. Geeral Purpose Hash Fuctio Algorithms. programmig/ hashfuctios/idex.html. [6] M. V. Ramakrisha, E. Fu, ad E. Bahcekapili. Efficiet Hardware Hashig Fuctios for High Performace Computers. IEEE Trasactio Computer, 46(12): , [7] H. Sog. Evaluatio of Packet Classificatio Algorithms. hs1/pclasseval.html, [8] H. Sog, J. Turer, S. Dharmapurikar, ad J. Lockwood. Fast Hash Table Lookup Usig Exteded Bloom Filter: A Aid to Network Processig. I Proceedigs of Coferece o Applicatios, Techologies, Architectures, ad Protocols for Computer Commuicatios, pages , August [9] V. Sriivasa. IP Lookup ad Packet Classificatio. PhD thesis, Washigto Uiversity, Sait lous, Missouri, August [10] V. Sriivasa. A Packet Classificatio ad Filter Maagemet System. I Proceedigs of Iteratioal IEEE Coferece INFOCOM, pages , [11] V. Sriivasa, S. Suri, ad G. Varghese. Packet Classificatio usig Tuple Space Search. I Proceedig of Coferece o Applicatios, Techologies, Architectures, ad Protocols for Computer Commuicatio, pages , [12] D. E. Taylor. Models, Algorithms, ad Architectures for Scalable Packet Classificatio. PhD thesis, Departmet of Computer Sciece ad Egieerig Washigto Uiversity, August V. OVERALL CONCLUSIONS I this paper, we preseted a itroductio to the classic packet classificatio problem ad oe classificatio algorithm called tuple search. A overview of hashig fuctios as part of packet classificatio algorithm i the tuple space was give. We implemeted a adaptive software packet classifier that fids optimal hashig fuctio through the class H3 hashig fuctios which is called H3 best. Our implemetatio shows that the utilizatio of a H3 class hashig fuctios i adaptive packet classificatio system decreases the umber of collisios ad average bucket size i compariso to other hashig fuctios. Deductio i umber of collisios, icreases packet classificatio performace ad throughput. REFERENCES [1] M. Ahmadi ad S. Wog. Modified Collisio Packet Classificatio Usig Coutig Bloom Filter i Tuple Space. I Procedigs of the

6 Rules-set Fuctio APH DJBH DEK ELF JS CRC FW1-1k FW1-5k FW1-10k TABLE III DIFFERENT GENERAL HASHING FUNCTIONS SPECIFICATION. 2 [log 2 ]+1 prime() 2 [log 2 ]+1 prime() prime() 2 [log 2 ]+1 FW (-%13) 8(-%66) FW1-1k 273 (-%3) 161(-%17) FW1-5k 1664(-%1) 777(%6) FW1-10k 3242(-%3) 1615(-%6) FW1 73 (-%14) 18(-%49) ACL1 235(-%7) 109(-%17) IPC1 469(-%7) 207(-%28) TABLE IV THE NUMBER OF COLLISIONS FOR DIFFERENT HASHING FUNCTIONS WITH DIFFERENT LOAD FACTORS. prime() 2 [log 2 ]+1 prime() 2 [log 2 ]+1 prime() 2 [log 2 ]+1 FW (-%22) 1.19(-%27) FW1-1k 1.57(-%2) 1.40(-%6) FW1-5k 1.57(-%2) 1.34(-%2) FW1-10k 1.53(-%2) 1.35(-%1.5) FW1 1.41(-%7) 1.42(-%7) ACL1 1.49(-%1.5) 1.28(-%1.5) IPC1 1.41(-%1.5) 1.26(-%9) TABLE V THE AVERAGE BUCKET SIZE FOR DIFFERENT HASHING FUNCTIONS AND DIFFERENT LOAD FACTORS. 2 [log 2 ]+1 prime() 2 [log 2 ]+1 prime() prime() 2 [log 2 ]+1 FW FW1-1k FW1-5k FW1-10k FW ACL IPC TABLE VI THE NUMBER OF OVERFLOWS WHEN THE BUCKET SIZE IS 2. & 2 [log 2 ]+1 prime() 2 [log 2 ]+1 prime() prime() 2 [log 2 ]+1 FW FW1-1k FW1-5k FW1-10k FW ACL IPC TABLE VII THE NUMBER OF OVERFLOWS WHEN THE BUCKET SIZE IS 3.