Skip to main content
Article thumbnail
Location of Repository

Efficient Multi-Match Packet Classification with TCAM

By Fang Yu and Randy H. Katz

Abstract

Today's packet classification systems are designed to provide the highest priority matching result, e.g., the longest prefix match, even if a packet matches multiple classification rules. However, new network applications, such as intrusion detection systems, require information about all the matching results. We call this the multi-match classification problem. In several complex network applications, multi-match classification is immediately followed by other processing dependent on the classification results. Therefore, classification should be even faster than the line rate. Pure software solutions cannot be used due to their slow speeds. In this paper, we present a solution based on Ternary Content Addressable Memory (TCAM), which produces multi-match classification results with only one TCAM lookup and one SRAM lookup per packet — about ten times fewer memory lookups than a pure software approach. In addition, we present a scheme to remove the negation format in rule sets, which can save up to 95 % of TCAM space compared with the straight forward solution. We show that using the pre-processing scheme we present, header processing for the SNORT rule set can be done with one TCAM and one SRAM lookup using a 135KB TCAM

Topics: Classification, Ternary CAM, Negation Removing
Year: 2009
OAI identifier: oai:CiteSeerX.psu:10.1.1.134.9215
Provided by: CiteSeerX
Download PDF:
Sorry, we are unable to provide the full text but you may find it at the following location(s):
  • http://citeseerx.ist.psu.edu/v... (external link)
  • http://www.cs.berkeley.edu/~fy... (external link)
  • Suggested articles


    To submit an update or takedown request for this paper, please submit an Update/Correction/Removal Request.