Performance Improvement of Hardware-Based Packet Classification Algorithm

Performance Improvement of Hardware-Based Packet Classification Algorithm Yaw-Chung Chen 1, Pi-Chung Wang 2, Chun-Liang Lee 2, and Chia-Tai Chan 2 1 Department of Computer Science and Information Engineering, National Chiao Tung University, HsinChu, 3 Taiwan, R.O.C. ycchen@csie.nctu.edu.tw 2 Telecommunication Laboratories, Chunghwa Telecom Co., Ltd., 7F, No. 9 Lane 74 Hsin-Yi Rd. Sec. 4, Taipei, 16 Taiwan, R.O.C. {abu, chlilee, ctchan}@cht.com.tw Abstract. Packet classification is important in fulfilling the requirements of differentiated services in next generation networks. In the previous work, we presented an efficient hardware scheme, Condensate Bit Vector, based on bit vectors. The scheme significantly improves the scalability of packet classification. In this work, the characteristics of Condensate Bit Vector are further illustrated, and two drawbacks that may negatively affect the performance of Condensate Bit Vector are revealed. We show the solution to resolve the weaknesses and introduce the new schemes, Condensate Ordered Bit Vector and Condensate and Aggregate Ordered Bit Vector. Experiments show that our new algorithms drastically improve the search speed as compared to the original algorithm. 1 Introduction Packet classification has been extensively employed in the Internet for secure filtering and service differentiation by administrators to reflect policies of network operations and resource allocation. Using the pre-defined policies, the packets can be assigned to various classes. However, packet classification with a potentially large number of policies is difficult and exhibits poor worst-case performance. In the previous work [1], we presented an efficient hardware scheme, Condensate Bit Vector, based on bit vectors. The scheme significantly improves the scalability of packet classification. In this work, the characteristics of Condensate Bit Vector are further illustrated, and two drawbacks that may negatively affect the performance of Condensate Bit Vector are revealed. In the following, we present how to resolve the weaknesses and introduce the new Condensate Ordered Bit Vector (CoBV) and Condensate and Aggregate Ordered Bit Vector (CAoBV) schemes. Experiments demonstrate that the new schemes drastically improve the search speed as compared to the original algorithm. This work is supported in part by the National Science Council under Grant No. NSC93-2752-E-9-6-PAE. P. Lorenz and P. Dini (Eds.): ICN 25, LNCS 3421, pp. 728 736, 25. c Springer-Verlag Berlin Heidelberg 25

Performance Improvement of Hardware-Based Packet 729 The rest of this paper is organized as follows. Section 2 introduces related works on packet classification and describes the ideas of Lucent BV, Aggregate Bit Vector (ABV) and Condensate Bit Vector (CBV) in details. Section 3 describes the main drawbacks of the CBV algorithm and presents CoBV and s. Section 4 evaluates the performance of the proposed scheme. Finally, Section 5 concludes the work. 2 Related Works Recently, researchers got more interested in the packet classification and had proposed several algorithms to solve the issue [2]. The related studies can be categorized into two classes: software-based and hardware-based. Several softwarebased schemes have been proposed in the literature such as grid of tries/crossproducting, tuple space search, recursive-flow classification, fat inverted segment trees, and hierarchical intelligent cuttings solutions [3 8]. The software-based solutions do not scale well in either time or storage, thus we focus on the hardwarebased solutions. In [9], Lakshman and Stiliadis proposed a scheme called. By constructing k one-dimensional tries, each prefix node in every one-dimensional trie is associated with a bit vector (bv). Each bit position maps to a corresponding policy in the database. The policy database is sorted by an descendent order of priority. By performing AND operation on all matched bv, the first matched result is the best matching policy. Since the length of bv increases proportional to the number of policies, the is only suitable for small-size policy databases. Baboescu et al. [1] proposed a bit-vector aggregation method to enhance the BV scheme. By adding aggregate bit vector (abv), the number of memory accesses is decreased significantly. While the improves the average speed of the BV scheme, it increases the required storage by appending extra abv for each bv as well. The CBV scheme [1] further improves the performance of ABV by merging multiple policies into one. Thus, both the speed and storage performance can be improved. The CBV scheme consists of three steps. In the first step, the prefixes extracted from the policies are used to construct the binary trie. For each onedimensional binary trie, the following procedure is executed to mark the subtrie root according to the pre-defined threshold. It checks whether the number of prefixes under the current node is equal to the threshold by traversing the binary trie with the depth first order. If yes, a subtrie root is marked. Otherwise, its left and right child nodes will be traversed recursively. Second, the prefixes in each policy are replaced by the bit-streams corresponding to the nearest ascending subtrie roots. Since new policies might be redundant, the duplicate copies are merged and the indices of the original policies are appended to the new policy. In the third step, the bvs are generated based on the new policies, namely cbv. Because the number of policies in the new database is reduced, the required bits

73 Y.-C. Chen et al. Table 1. Two-dimensional policy database with 16 rules Source Dest. Source Dest. Source Dest. Source Dest. Index Prefix Prefix Index Prefix Prefix Index Prefix Prefix Index Prefix Prefix F * 11* F 4 111* * F 8 1* 11* F 12 * 1* F 1 * * F 5 * 11* F 9 11* 1* F 13 11* 1* F 2 1* 1111* F 6 * 1111* F 1 * 11* F 14 1* * F 3 1* 1* F 7 1* 111* F 11 11* * F 15 * * Source Prefixes P * P 4 111* P 5 1* P 1 * P 6 11* P 2 1* 1 P 7 P 3 1* P 7 * 1 111 111 P 1 P 2 11 111 1111 11111 P 3 P 5 111 111 1111 1111111 1111111 1111 P P 6 P 4 111 1111 Destination Prefixes P 11* P 5 11* P 6 111* P 1 * P 7 1* P 2 1111* P 8 11* P 3 1* 11 P 4 * P 9 * P 9 1 1 1 11111 P 4 P 7 P 1 1 111 11 11111 P 3 P 5 11 111 111 11111 1111 P 1 P 8 P 6 P 2 11 1111 11 111 1 (a) Source trie (b) Destination trie Fig. 1. Bit vectors constructed by BV and in each bit vector is less than that in the Lucent BV. Furthermore, the number of different prefixes in each dimension is reduced to generate fewer vectors. We use a two-dimensional policy (source prefix, destination prefix) database with 16 policies in Table 1 to illustrate the bit-vector construction of the Lucent BV, ABV and CBV schemes. The prefix nodes for the source and destination tries are depicted as the shady nodes in Fig. 1. Each prefix node in both tries is labeled with two bit vectors, bv (16 bits) and abv (4 bits). The bv length is equal to the number of policies in the database and the length of abv is altered by the aggregate size (4). For an incoming address pair (11, 111), uses the source address 11 to walk through the source trie and receives the bv value 1111111. Similarly, it gets a bv value 11111 in the destination trie. Finally, performs an AND operation on these two bvs and obtains a result of 1 showing that the matched policy is F 12. With the, an AND operation on the abvs 1111 and 111 yields result 111. It indicates that the second 4-bit segment will not contain any set bits and could be ignored. Next, the procedures of CBV scheme is presented. Assuming that the number of clustered prefixes is 2. After performing the proposed algorithm to the trie in Fig. 1, the constructed subtrie roots are shown in Fig. 2. Each dark-gray circle represents the position of the subtrie root. Next, the original prefixes in each policy are replaced by the bit-streams corresponding to the nearest ascending subtrie roots. For example, F (, 11 ) in Table 1 is changed to (, 11 ), and F 6 (, 1111 ) is changed to (, 111 ). Some new policies are redundant,

Performance Improvement of Hardware-Based Packet 731 Condensed Source Prefixes P ' 1* P ' 1 * P ' 2 1* P ' 3 * P 7 11111 111 P 1 1 111111 P 3 P 5 111 1 1111 P 2 111 Condensed Destination Prefixes P ' * P ' 1 1* 11 P ' 2 111* 1 3 P ' 11* P ' 4 * P 9 111 11111 111 P 4 11 P 7 P 3 P 5 11 P 11 1111 111 P P 6 P 4 P 1 P 8 P 6 P 2 (a) Source trie (b) Destination trie Fig. 2. Bit Vector Condensation Table 2. New Policy Database First Second Included First Second Included Index Dimension Dimension Policies Index Dimension Dimension Policies F * 11* F,F 5 F 5 * 111* F 6 F 1 * * F 1 F 6 1* 11* F 8 F 2 1* 111* F 2,F 7 F 7 1* * F 9,F 11 F 3 1* 1* F 3,F 13 F 8 * 1* F 1,F 12 F 4 1* * F 4,F 14 F 9 * * F 15 e.g. the new policies generated by F and F 5. These policies are merged, and their indices are appended to the new policy. Table 2 presents the new policy database. Then, the bv is constructed based on the new policy database. The 16-bit bvs is transformed into new 1-bit bvs, as shown in Fig. 2. In addition, the number of bvs is reduced from 18 to 9 with the proposed scheme. Also in Fig. 2, the condensate bit vector with aggregation is illustrated, namely condensate and aggregate bit vector (cabv). The aggregate size is defined as 4 in these cases. The construction of cabv follows the same procedure as that of abv. 3 Condensate Ordered Bit Vector (CoBV) As described above, the CBV scheme is simple and efficient. By merging policies according to their prefixes, the number of bit vectors and their lengths can be significantly reduced, hence the totally required storage is dramatically decreased. In addition, the CBV scheme combining ABV can further improve the performance of packet classification. Nevertheless, the native CBV scheme has two drawbacks. The first is the way that the CBV scheme clusters the policies. As described in the first step of cbv generation, the common prefixes of the original prefixes in the policies are selected from the binary trie. The threshold for the

732 Y.-C. Chen et al. common prefix selection is based on the number of successive prefixes in the binary trie. Nevertheless, each prefix might be referred by multiple filters, and the number of merged policies for each newly generated policies is difficult to manage. This might cause the worst-case search performance degraded since each merged policy of the matching new policies must be retrieved to decide whether it is a matched one. The second is that the policies in CBV do not follow the order of priority. This is because the CBV scheme clusters the policies according to the related position of their prefixes in the binary trie. Therefore, the policies with different priority may be clustered into one new policies and causes the generated policies difficult to sort. Therefore, each matched policies must be retrieved to decide the one with least cost. Consequently, the average search performance is decreased. However, the worst-case search performance is not affected since the whole cbv is traversed in the worst situation. The same phenomenon also occurs in ABV, where the policies are reordered in order to improve the performance of aggregation. Aiming to the two drawbacks described above, we propose two new ideas, clustering based on the number of filters and bit vector ordering, to improve the CBV scheme. Next, the detailed procedures of these two ideas are described. The first drawback is resolved by introducing a different threshold for prefix generating. The original CBV scheme generates prefixes according to the number of successive prefixes. However, the number of successive prefixes is less meaningful for packet classification since it only reflects one-dimensional information. To correct this, the number of filters, which refer to the successive prefixes, is used to decide whether the successive prefixes are clustered. The first step of CBV construction procedure is modified as follows. While constructing the binary tries, each prefix node is tagged with the number of referring policies. Next, the prefix generating procedure decides whether the current node is marked as a prefix by summing up the number of referring policies in every successive prefix. If the resulted value is larger than the predefined threshold, the current node is marked as a prefix node. The path from root to the prefix node is then extracted as a new prefix. To resolve the second drawback, we cluster only the policies with identical priority. The first step of CBV construction procedure is the same. After generating the prefixes according to the predefined threshold, the original prefixes in the policies are replaced by the newly generated prefixes. In the CBV scheme, the policies with identical prefixes are merged. The step is modified by only merging the policies with identical prefixes and priority. The resulted bit vector is called condensate ordered bit vector (cobv). Consequently, the search procedure can be terminated by retrieving the first matching policies. Hence the average search performance can be improved. However, the effect of policies clustering is reduced and might increase the required storage. To alleviate the storage expansion caused by cobv, a larger threshold for prefix generating is necessary. By combined the new procedures with bit aggregation, the condensate and aggregated ordered bit vector (caobv) is generated. In the next section, we demonstrate that CoBV and CAoBV outperform the existing schemes.

4 Performance Evaluation Performance Improvement of Hardware-Based Packet 733 In this section, we evaluate the performance of the CoBV and s and compare it with Lucent BV, ABV and CBV schemes. To test the scalability of our CBV scheme, the synthetic databases are used to evaluate whether CBV scheme could accommodate the future network service configurations. The synthetic databases are generated by randomly selecting the source and destination addresses in these 22 classifiers. The size of our synthetic databases varies from 1K to 1K. Assume that the memory word size and the aggregate size of ABV are both 32 bits, identical to the settings used in [1]. Two performance metrics are measured in our experiments: the storage requirement and the classification speed. The required storage mainly ties to the number of bit vectors and their length. The number of bit vectors is equal to the number of prefix nodes, while their lengths is identical to the number of policies. The speed of each packet classification is measured in terms of the number of memory accesses. In our experiments, the numbers of clustered filters are set to 32, 64, 128, 256. Since the numbers of clustered filters do not affect the Lucent BV and s, their storage requirement and speed will remain constant. In the 6, 6, 5, 5, 4, 3, 2, 4, 3, 2, 1, 1, 1, 2, 3, 4, 5, 6, 7, 8, 9, 1, 1, 2, 3, 4, 5, 6, 7, 8, 9, 1, (a) Clustered filters = 32 (b) Clustered filters = 64 6, 6, 5, 5, 4, 3, 2, 4, 3, 2, 1, 1, 1, 2, 3, 4, 5, 6, 7, 8, 9, 1, 1, 2, 3, 4, 5, 6, 7, 8, 9, 1, (c) Clustered filters = 128 (d) Clustered filters = 256 Fig. 3. Storage requirement in synthetic databases (lower is better)

734 Y.-C. Chen et al. 7, 7, 6, 5, 4, 3, 2, 6, 5, 4, 3, 2, 1, 1, 1, 2, 3, 4, 5, 6, 7, 8, 9, 1, 1, 2, 3, 4, 5, 6, 7, 8, 9, 1, (a) Clustered filters = 32 (b) Clustered filters = 64 7, 7, 6, 5, 4, 3, 2, 6, 5, 4, 3, 2, 1, 1, 1, 2, 3, 4, 5, 6, 7, 8, 9, 1, 1, 2, 3, 4, 5, 6, 7, 8, 9, 1, (c) Clustered filters = 128 (d) Clustered filteres = 256 Fig. 4. Worst case memory access in synthetic databases (lower is better) following, the performance of CoBV and s are evaluated first. Then, a comparison with CBV/CABV is presented. First, the required storage of the proposed scheme for synthetic databases is presented. The characteristics of the synthetic databases are similar to that of the large real-world classifiers. Figure 3 shows the results for various settings. Since the prefixes in the synthetic databases are sampled uniformly, the slopes are quite smooth. Drastic increases in storage reduction can be seen as the number of clustered filters increases. In Fig. 4, we demonstrate the search performance of our schemes with synthetic classifiers. The number of memory accesses increases linearly as the size of classifier increases. Figure 4(a) and 4(b) show that the performance of the is similar to that of the. For the 8K-entry classifier, the effect of false match degrades the performance of the proposed schemes, as seen in Fig. 4(b). However, the superiority of the proposed schemes is demonstrated as the number of the clustered filters increases. In Fig. 4(c) and 4(d), the outperforms the. The performance of CBV and CABV is further compared with the proposed scheme based on synthetic databases. The various settings for CBV/CABV (p=2 or 4) and CoBV/CAoBV (f=128 or 256) are adopted since their properties are

Performance Improvement of Hardware-Based Packet 735 25, 6, 2, 15, 1, CBV scheme (p=2) C (p=2) CBV scheme (p=4) C (p=4) (f=128) (f=128) (f=256) (f=256) 5, 4, 3, 2, CBV scheme (p=2) C (p=2) CBV scheme (p=4) C (p=4) (f=128) (f=128) (f=256) (f=256) 5, 1, 1, 2, 3, 4, 5, 6, 7, 8, 9, 1, 1, 2, 3, 4, 5, 6, 7, 8, 9, 1, (a) Storage Comparison (b) Speed Comparison Fig. 5. Comparisons with CBV and CABV quite different. As the number of clustered filter is large enough, the required storage of CoBV/CAoBV can be less than that of CBV/CABV. In the mean time, CoBV/s can also achieve better search performance. Therefore, CoBV/s can feature better scalability as compared with existing bit-vector algorithms. 5 Conclusions In this work, we proposed the condensate ordered bit vector to improve the classification performance of bit-vector algorithms. The ideas of CoBV include clustering based on the number of filters and bit vector ordering. While the first improves the worst-case search performance, and the second promotes the average performance. By demonstrating the performance based on real and synthetic policies databases, the CoBV and s can outperform CBV/CABV schemes and other existing bit-vector algorithms. In conclusion, the flexibility of CoBV/s can significantly improve the performance of packet classification for large policy databases. References 1. Chang, H., Chan, C., Wang, P., Lee, C.: A scalable hardware solution for packet classification. In: IEEE ICCS 24. (24) 542 546 2. Gupta, P., Mckneown, N.: Algorithms for packet classification. In: IEEE Network Magazine. (21) 24 32 3. Srinivasan, V., et al.: Fast and scalable level four switching. In: ACM SIGCOMM 98. (1998) 191 22 4. Srinivasan, V., Suri, S., Varghese, G.: Packet classification using tuple space search. In: ACM SIGCOMM 99. (1999) 135 146 5. Gupta, P., McKeown, N.: Packet classification on multiple fields. In: ACM SIG- COMM 99. (1999) 147 16

736 Y.-C. Chen et al. 6. Pankaj Gupta and Nick McKeown: Packet Classification using Hierarchical Intelligent Cuttings. IEEE Micro 2 (2) 34 41 7. Anja Feldmann and S. Muthukrishnan: Tradeoffs for Packet Classification. In: IEEE INFOCOM. (2) 1193 122 8. Woo, T.Y.C.: A modular approach to packet classification: Algorithms and results. In: INFOCOM (3). (2) 1213 1222 9. Lakshman, T., Stiliadis, D.: High-speed policy-based packet forwarding using efficient multi-demensional range matching. In: ACM SIGCOMM 98. (1998) 23 214 1. Baboescu, F., Varghese, G.: Scalable packet classification. In: ACM SIGCOMM 1. (21) 199 21