Table Of ContentIEEE/ACMTRANSACTIONSONNETWORKING,VOL.13,NO.1,FEBRUARY2005 1
Editorial
THE IEEE/ACM TRANSACTIONSON NETWORKING (ToN) reviewerswhohelpedusin2004.ThecontinuedsuccessofToN
has continued to archive the highest quality papers pub- isduelargelytothewillingnessofreviewerstoinvesttheirtime
lishedbytheNetworkingcommunity.Wepublished90papers and effort to read and critique manuscripts. I hope that if you
in2004,anincreaseovertheprioryearthatwasmadepossible receivearequesttoreviewaToNsubmission,youwillrespond
byanincreaseinpagebudget.ToNcontinuestoseeincreasesin positivelyandinatimelyfashion.
thenumberofsubmittedpapers.Wereceived461originalsub- I would also like to acknowledge the efforts of the ToN
missionsin2004,anincreaseofabout5%over2003. EditorialBoard.EachEditorhandlesbetween10and15papers
In a somewhat belated fashion, I am pleased to announce ayear,carefullyselectingreviewerswithexpertiseandreaching
that the 2004 William R. Bennett Prize for the best orig- a decision based heavily on reviewer feedback. Good editors
inal paper published in the IEEE/ACM TRANSACTIONS ON are central to ToN’s success. We were fortunate to have nine
NETWORKING in the prior year was awarded to Ion Stoica, new Editors join the ToN Editorial Board in 2004: Ramon
Robert Morris, David Liben-Nowell, David R. Karger, M. Caceres (IBM), Samir Das (SUNY Stony Brook), Tim Griffin
Frans Kaashoek, Frank Dabek, Hari Balakrishnan, for their (Intel),RaviMazumdar(Purdue),FernandoPaganini(UCLA),
paper"Chord:AScalablePeer-to-PeerLookupProtocolforIn- MattRoughan(Univ.ofMelbourne),ArunSomani(IowaState
ternet Applications," published in IEEE/ACM TRANSACTIONS Univ.), Darryl Veitch (Univ. of Melbourne), and David Yau
ON NETWORKING, vol. 11, no. 1, pp. 17-32, February 2003. (Purdue).
Twootherpaperswerenominatedfortheprize: The following Editors have stepped down in 2004: Ken
“DirectedDiffusionforWirelessSensorNetworking,”C. Calvert(Univ.ofKentucky),ReuvenCohen(Technion),Venkat
Intanagonwiwat, R. Govindan, D. Estrin, J. Heidemann, Padmanabhan(Microsoft),SanjoyPaul(Lucent),VernPaxson
F.Silva,vol.11,no.1,February2003 (BerkeleyICSI),BalajiPrabhakar(Stanford),GeorgeRouskas
(NC State). All retired Editors continue to manage the re-
and
viewing process for papers previously assigned to them. On
“End-to-endcongestioncontrol:utilityfunctions,random
behalf of the Networking community, I would like to thank
lossesandECNmarks,”S.KunniyurandR.Srikant,vol.
theseretiringEditorsfortheirefforts.
11,no.5,Oct.2003.
Ilookforward toanotherbusyandinterestingyearforToN
Congratulationstoalloftheseauthorsfortheirexcellentwork.
in 2005.
The production of ToN is truly a collaborative community
effort. At the end of this issue, we list the names of the 683
ELLENW.ZEGURA,Editor-in-Chief
CollegeofComputing
GeorgiaInstituteofTechnology
DigitalObjectIdentifier10.1109/TNET.2005.845327 Atlanta, GA 30332-0280 USA
1063-6692/$20.00©2005IEEE
2 IEEE/ACMTRANSACTIONSONNETWORKING,VOL.13,NO.1,FEBRUARY2005
Scalable Packet Classification
Florin Baboescu and George Varghese, Member, IEEE
Abstract—Packet classification is important for applications A. ScalablePacketClassification
suchasfirewalls,intrusiondetection,anddifferentiatedservices.
This paper is about the problem of performing scalable
Existingalgorithmsforpacketclassificationreportedintheliter-
aturescalepoorlyineithertimeorspaceasfilterdatabasesgrow packet classification for routers at wire speeds even as rule
insize.HardwaresolutionssuchasTCAMsdonotscaletolarge databases increase in size. Forwarding at wire speeds requires
classifiers.However,evenforlargeclassifiers(say,100000rules), forwarding minimum sized packets in the time it takes to
any packet is likely to match a few (say, 10) rules. This paper
arrive on a link; this is crucial because otherwise one might
seeks to exploit this observation to produce a scalable packet
classificationschemecalledAggregatedBitVector(ABV).Ittakes drop important traffic before the router has a chance to know
thebitvectorsearchalgorithm(BV)describedinLakshmanand it is important [14]. With Internet usage doubling every six
Stidialis,1998(whichtakeslineartime)andaddstwonewideas, months, backbone link speeds have increased from OC-48 to
recursive aggregation of bit maps and filter rearrangement, to
OC-192(2.4–10Gb/s),andspeedsuptoOC-768(40Gb/s)are
createABV(whichcantakelogarithmictimeformanydatabases).
We show that ABV outperforms BV by an order of magnitude projected.Evenlinkspeedsatthenetworkedgehaveincreased
using simulations on both industrial firewall databases and syn- fromEthernet(10Mb/s)toGigabitEthernet.
theticallygenerateddatabases. Further,ruledatabasesareincreasinginsize.Theinitialusage
of packet classification for security and firewalls generally re-
I. INTRODUCTION sulted in fairly small databases (e.g., the largest database in a
EVERYInternetroutertodaycanforwardenteringInternet largenumberofCiscorulesetsstudiedby[11]isaround1700).
Thismakessensebecausesuchrulesareoftenenteredbyman-
messages(packets)basedonthedestinationaddress.The
agers.However,intheverypopularDifferentiatedServices[7]
32-bitIPdestinationaddressislookedupinatablewhichthen
proposal,theideaistohaveroutersattheedgeofthebackbone
determines the output link on which the packet is sent. How-
classifypacketsintoafewdistinctclassesthataremarkedbybits
ever,foracompetitiveadvantage,manyrouterstodaychooseto
intheTOSfieldoftheIPheader.Backboneroutersthenonlylook
doadditionalprocessingfora specificsubsetofpackets.Such
attheTOSfield.If,asseemslikely,theDiffServproposalreaches
additional processing includes providing differentiated output
scheduling (e.g., Voice over IP packets are routed to a high fruition,therulesetsforedgerouterscangrowverylarge.
priority queue), taking security-related actions (e.g., dropping Similarly,rulesetsforedgeroutersthatdoloadbalancing[5]
packetssentfromacertainsubnet),loadbalancing(e.g.,routing can growverylarge. Such rulesetscan potentially be installed
packetstodifferentservers)anddoingtrafficmeasurement(e.g., atroutersbyaprotocol;alternately,arouterthathandlesseveral
measuringtrafficbetweensubnetpairs). thousandsubscribersmayneedtohandlesay,10rulespersub-
Although the details of the additional processing can vary scriberthataremanuallyentered.Itmaybethatsuchcustomer
greatly,acommonrequirementofallthefunctionsaboveisthat aggregationisthemostimportantreasonforcreatinglargeclas-
routersbeabletoclassifypacketsbasedonpacketheadersinto sifiers. Thus, we believe rule databases of up to 100000 rules
equivalenceclassescalledflows.Aflowisdefinedbyarule—for areofpracticalinterest.
example the set of packets whose source address starts with
prefix bits , whose destination address is , and which are II. PREVIOUSWORK
senttotheserverportforwebtraffic.Associatedwitheachflow
Previouswork inpacket classification[11],[12], [14],[20],
isanactionwhichdefinestheadditionalprocessing—example
[21] has shown that the problem is inherently hard. Most
actionsincludesendingtoaspecificqueue,droppingthepacket,
practical solutions use linear time [14] to search through all
makingacopy,etc.
rules sequentially, or use a linear amount of parallelism (e.g.,
Thus,packetclassificationroutershaveadatabaseofrules,one
Ternary-CAMs[15]).TernaryCAMsareContentAddressable
foreachflowtypethattherouterwantstoprocessdifferently.The
Memories that allow wildcard bits. While Ternary-CAMs are
rulesareexplicitlyorderedbyanetworkmanager(orprotocol)
verycommon,suchCAMs havesmaller densitythan standard
thatcreatestheruledatabase.Thus,whenapacketarrivesata
memories, dissipate more power, and require multiple entries
router,theroutermustfindarulethatmatchesthepacketheaders;
to handle rules that specify ranges. Thus, CAM solutions are
ifmorethanonematchisfound,thefirstmatchingruleisapplied.
still expensive for very large rule sets of, say, 100000 rules,
andarenotpracticalforPC-basedrouters[16].Solutionsbased
ManuscriptreceivedAugust7,2002;revisedJanuary2,2004;approvedby oncaching[22]donotappeartoworkwellinpracticebecause
IEEE/ACMTRANSACTIONSONNETWORKINGEditorE.Zegura.Theworkof
ofpoorhitratesandsmallflowdurations[18].
F.BaboescuandG.VarghesewassupportedbytheNationalScienceFoundation
underNSFGrantANI0074004. Anotherpracticalsolutionisprovidedbyaseminalpaperthat
TheauthorsarewiththeDepartmentofComputerScienceandEngineering, werefertoastheLucentbitvectorscheme[14].Theideaisto
University of California at San Diego, La Jolla, CA 92093 USA (e-mail:
firstsearchforrulesthatmatcheachrelevantfield ofthepacket
[email protected];[email protected]).
DigitalObjectIdentifier10.1109/TNET.2004.842232 header,andtorepresenttheresultofthesearchasabitmapof
1063-6692/$20.00©2005IEEE
BABOESCUANDVARGHESE:SCALABLEPACKETCLASSIFICATION 3
Fig.2. TotalmemoryspaceoccupiedbythesearchstructuresinRFC[11],
HiCuts[12],andthebitvectorscheme(BV)[14].Thesizeisinmemorywords,
onememorywordis32bits.ThefilterdatabasesaredescribedinFig.9.
Fig.3. TotalnumberofmemoryaccessesforaworstcasesearchinRFC[11],
HiCuts[12]andthebitvectorscheme(BV)[14].Onememoryaccessisone
word.Onewordis32bits.ThefilterdatabasesaredescribedinFig.9.
Fig. 1. Time-memory complexity for algorithmic solutions for the packet
exponentialinthenumberofrules.TheHiCutsalgorithmusesa
classificationproblem.
memoryspacethatislinearinthenumberofrules.However,the
rulesthatmatchthepacketinfield .Thentherulesthatmatch sizeofthisspacemaybemultipliedwithalargeconstantinthe
the full header can be found by taking the intersection of the casethatthelistsstoredintheleafnodeshasalargenumberof
bitmapsforallrelevantfields .Whilethisschemeisstilllinear duplications. The bit vector search algorithm has also a linear
inthesizeoftheruleset,inpracticesearchingthroughabitmap memory space utilization given by storing the bit vectors that
isfastbecausealargenumberofbits(upto1000inhardware,up areusedinrepresentingthematchingrulesassociatedwitheach
to128bitsinsoftware)canberetrievedinonememoryaccess. prefixnodeinthesearchstructures.Theworstcasecomplexity
WhiletheLucentschemecanscaletoaroundareasonablylarge of the searches is linear in the number of rules in the case of
number of rules (say, 10000) the inherently linear worst case thebitvectorsearchalgorithm.Thecomplexityofthesearchis
scalingmakesitdifficulttoscaleuptolargeruledatabases. logarithmicinthenumberofrulesinthecaseofHiCuts.RFC
From a theoretical standpoint, it has been shown [14] that and crossproducting have a constant search time complexity,
in its fullest generality, packet classification requires either independentonthenumberofrules.Fig.2showsthememory-
timeandlinearspace,or timeand timetradeoffforRFC,HiCutsandthebitvectorsearchscheme
space,where isthenumberofrules,and isthenumberof inthecaseoffourdifferentreallifefirewalldatabasesthatare
header fields used in rules. Thus, it comes as no surprise that describedinFig.9.
thesolutionsreportedintheliteraturefor eitherrequire Finally, there are several algorithms that are specialized for
large worst case amounts of space (e.g., crossproducting [20], the case of rules on two fields (e.g., source and destination IP
RFC [11], HiCuts [12])1 or time (e.g., bit vector search [14], address only). For this special case, the lower bounds do not
backtracking[20]). apply(theyapplyonlyfor );thushardlysurprisingly,there
However,thepapersbyGuptaandMcKeown[11],[12]intro- are algorithms that take logarithmic time and linear storage.
ducedamajornewdirectionintopacketclassificationresearch. These include the use of range trees and fractional cascading
Sincetheproblemisunsolvableintheworstcase,theylookin- [14],grid-of-tries[20],area-basedquad-trees[4],andFIS-trees
steadforheuristicsthatworkwelloncommonrulesets.Inpar- [8].Whilethesealgorithmsareusefulforspecialcases,theydo
ticular,aftersurveyingalargenumberofrulesets[11],theyfind not solve the general problem. While the FIS trees paper [8]
thatmultipleruleintersectionisveryrare.Inotherwords,itis sketches an extension to and suggests the use of clus-
veryraretohaveapacketthatmatchesmultiplerules.Sincethe teringtoreducememory,thereisaneedtoexperimentallyeval-
examples that generate the worst case bounds entail multiple uatetheirideaonreal(evensmall)multidimensionalclassifiers.
rulesetsthatintersect,itisnaturaltowonderwhetherthereare In summary, for the general classification problem on three
schemesthatareprovablybettergivensomesuchstructuralas- ormorefields,wefindthatexistingsolutionsdonotscalewell
sumptiononrealdatabases. inoneoftimeorstorage.OurpaperusestheLucentbitvector
Amongthepapersthatreportheuristics[11],[12],[21],the schemeasapointofdeparturesinceitalreadyscalestomedium
resultsonrealdatabasesare,indeed,betterthantheworstcase sizedatabases,andisamenabletoimplementationusingeither
bounds. Fig. 1 shows the time-memory relation for these type hardwareorsoftware.OurAggregatedBitVector(ABV)scheme
ofschemes.AsexpectedRFCoccupiesamemoryspacethatis addstwonewideas,ruleaggregationandrulerearrangement,
toenhancescalability.
1ThetreesearchstructureoftheHiCuts[12]algorithmoccupiesalinearspace
inthenumberofrules.Howevereachleafnodestoresalistofrulesthatarea
A. PreviousWorkinEfficientRepresentationofSparseSets
possiblematch.Thislistneedstobetraversedinordertoidentifythematching
ruleofthesearch.Inordertoprovideagoodsearchthroughputeachoftheselists Bit vectors are a natural way to represent sparse sets. How-
mustbestoredindifferentmemoryspaces.Asaresulttheinformationrelatedto
ever,operationssuchassetintersectiontake usingbitvec-
arulemaygetduplicatedintomultiplelistsandthereforeincreasestheoverall
memoryspace. tors, where is the size of the universe which is represented.
4 IEEE/ACMTRANSACTIONSONNETWORKING,VOL.13,NO.1,FEBRUARY2005
kinds of matches: exact match, prefix match, or range match.
Inanexactmatch,theheaderfieldofthepacketshouldexactly
matchtherulefield,forinstance,thisisusefulforprotocoland
flagfields.Inaprefixmatch,therulefieldshouldbeaprefixof
theheaderfield;thisisusefulforblockingaccessfromacertain
subnetwork. In a range match, the header values should lie in
therangespecifiedbytherule;thisisusefulforspecifyingport
numberranges.
Each rule has an associated action , which specifies
Fig.4. Brigg’srepresentationforasetmadeupoffourelements{1,3,6,9}. howtoforwardthepacketmatchingthisrule.Theactionspec-
ThetotalnumberofelementswhichmayberepresentedisN. ifiesifthepacketshouldbeblocked.Ifthepacketistobefor-
warded,itspecifiestheoutgoinglinktowhichthepacketissent,
Anefficientsparsesetrepresentationforcompilerapplications andperhapsalsoaqueuewithinthatlinkifthemessagebelongs
(whichallowssetintersectionintimeproportionaltotheactual toaflowwithbandwidthguarantees.
sizesofthesetsbeingintersected)isdescribedin[3]. We say that a packet matches a rule if each field of
The sparse set representation used in [3] has three compo- matches the corresponding field of —the match type
nents: two vectors, each with the length , and a scalar that is implicit in the specification of the field. For instance, let
recordsthenumberofmembersintheset.Thetwovectorsare be a rule, with
calledsparseanddense.Thescalarvalueidentifiesthenumber . Then, a packet with header ( ,
ofelementsinthesetaswellasthenumberofelementsinthe , TCP, 1050, 3) matches , and is therefore
densevector.Fig.4showstherepresentationofasetmadeup dropped. The packet ( , , TCP, 80,
offourelements;themaximumnumberofelementswhichmay 3), on the other hand, does not match . Since a packet may
be represented is . The values in the dense vector point to match multiple rules, we define the matching rule to be the
membersinthesparsevector,whichpointbackintothedense earliestmatchingruleinthesequenceofrules2.
vector. If an element is a member of the set, it must satisfy We wish to do packet classification at wire speed for min-
twoconditions: imumsizedpacketsandthusspeedisthedominantmetric.Be-
causebothmodernhardwareandsoftwarearchitecturesarelim-
• ;
itedbymemorybandwidth,itmakessensetomeasurespeedin
• .
termsofmemoryaccesses.Itisalsoimportanttoreducethesize
WecallthisBrigg’srepresentation.
of the data structure that is used to allow it to fit into the high
The representation provides constant time implementations
speedmemory.Thetimetoaddordeleterulesisoftenignored,
for operations like find a member, add a member, or delete a
butitisimportantfordynamicrulesets,thatcanoccurinreal
member. It also provides an asymptotic complexity of
firewalls. Our scheme can also be modified to handle fast up-
where is the number of members, for operations like copy
datesatthecostofslightlyincreasedsearchtime.
aset, compare sets,union, intersection, and difference ofsets.
Fortheseoperations,bitvectorrepresentationtakes time
where isthesizeoftheuniverse. IV. TOWARDSANEWSCHEME
These results suggest that Brigg’s representation could re- Weintroducetheideasbehindourschemebyfirstdescribing
place the bit vectors in the Lucent bit vector scheme and re- the Lucent bit vector scheme as our point of departure. Then,
duce time complexity. However, in Section VI we show that using an example rule database, we show our two main ideas:
our ABV scheme can do much better than the Briggs scheme aggregationandrulerearrangement.Inthenextsection,wefor-
withoutbeingmuchworseintheworstcase. mallydescribeournewscheme.
III. PROBLEMSTATEMENT A. BitVectorLinearSearch
Assume that information relevant to lookup is contained in TheLucentbitvectorschemeisaformofdivide-and-conquer
distinct packet header fields, denoted by , whichdividesthepacketclassificationprobleminto subprob-
whereeachfieldisabitstring.Forinstance,therelevantfields lems,andthencombinestheresults.Todoso,wefirstbuild
foranIPv4packetcouldbetheDestinationAddress(32bits), one-dimensionaltriesassociatedwitheachdimension(field)in
theSourceAddress(32bits),theProtocolField(8bits),theDes- theoriginaldatabase.Weassumethatrangesareeitherhandled
tinationPort(16bits),theSourcePort(16bits),andTCPflags using a range tree instead of a trie, or by converting ranges to
(8 bits). Thus, the combination ( , , TCP-ACK, 80, 2500), triesasshownin[20],[21].An -bitvectorisassociatedwith
denotes the header of an IP packet with destination , source eachnodeofthetriecorrespondingtoavalidprefix.(Recallthat
,protocolTCP,destinationport80,sourceport2500,andthe isthetotalnumberofrules).
ACKbitset.Notethatmanyruledatabasesallowtheuseofother Fig.6illustratestheconstructionforthesimpletwo-dimen-
headerfieldsbesidesTCP/IPsuchasMACaddresses,andeven sional example database in Fig. 5. For example, in Fig. 5, the
Application(e.g.,http)headers. secondrule has00*inthefirstfield.Thus,theleftmostnode
Theruledatabaseofarouterconsistsofafinitesequenceof
2Sometimeswerefertothelowestcostruleinsteadofthefirstmatchingrule.
rules, . Each rule is a combination of values,
Thetwodefinitionsareequivalentifthecostofaruleisitspositioninthese-
one for each header field. Each field in a rule is allowed three quenceofrules
BABOESCUANDVARGHESE:SCALABLEPACKETCLASSIFICATION 5
B. ReducingAccessesbyAggregation
Recallthatwearetargetingthehighcostinmemoryaccesses
which essentially scales linearly ( ) except that the con-
stantfactorisscaleddownbythewordsizeoftheimplementa-
tion.Withawordsizeofupto1000inhardware,sucha“con-
stant”factorimprovementisabiggaininpractice.However,we
wanttodobetterbyatleastoneorderofmagnitude,andremove
thelineardependenceon .Tothisend,weintroducetheidea
ofaggregation.
The main motivating idea is as follows. We hope that if we
considerthebitvectorsproducedbyeachfield,thesetbitswill
Fig.5. Asimpleexamplewith11rulesontwofields.
beverysparse.Forexample,fora100000ruledatabase,ifthere
areonly5bitssetinabitvectorofsize100000,itseemsawaste
toread100000bits.Whydowebelievethatbitvectorswillbe
sparse?Wehavethefollowingarguments:
• Experience:Inthedatabaseswehaveseen,everypacket
matches at most four rules. Similar small numbers have
beenseenin[12]foralargecollectionofdatabasesupto
1700rules.
• Extension:Howwilllargedatabasesbebuilt?Iftheyare
basedonaggregatingseveralsmallclassifiersforalarge
number of classifiers, it seems likely that each classifier
willbedisjoint.Iftheyarebasedonaroutingprotocolthat
distributed classifiers based on prefix tables, then prefix
containmentisquiterareinthebackbonetableandislim-
itedtoatmostsix[21].Again,ifapacketmatchesalarge
number of rules, it is difficult to make sense of the or-
deringrulesthatgiveonerulepriorityoverothers.
Thefactthatagivenpacketmatchesonlyafewrulesdoesnot
Fig.6. TwotriesassociatedwitheachofthefieldsinthedatabaseofFig.5,
imply that the packet cannot match a large number of rules in
togetherwithboththebitvectors(boxed)andtheaggregatevectors(bolded)
associatedwithnodesthatcorrespondtovalidprefixes.Theaggregatebitvector alldimensions(becauseonlyafewmatchescouldalignproperly
has3bitsusinganaggregationsizeof4.Bitsarenumberedfromlefttoright. inalldimensions).However,assumefornowthereissomedi-
mension whosebitvectorissparse.3Toexploittheexistence
in the trie for the first field, corresponds to 00*. Similarly, the of such a sparse vector, our modified scheme, appends the bit
Field1triecontainsanodeforalldistinctprefixesinField1of vector for each field in each trie with an aggregate bit vector.
Fig.5suchas00*,10*,11*,1*,and0*. First, we fix an aggregate size . is a constant that can be
Eachnodeinthetrieforafieldislabeledwitha -bitvector. tuned to optimize the performance of the aggregate scheme;
Bit inthe vector is set if the prefix corresponding torule a convenient value for is the word size. Next, a bit
inthedatabasematchestheprefixcorrespondingtothenode.In is set in the aggregate vector if there is at least one bit set,
Fig. 5, notice that the prefix 00* in Field 1 is matched by the .Inotherwords,wesimplyaggregate
values00*and0*,whichcorrespondtovaluesinrules0,1,4, each group of bits in the Lucent bit vector into a single bit
5and6.Thus,the11-bitvectorshownbehindtheleftmostleaf (which represents the OR of the aggregated bits) in the aggre-
node in the top most trie of Fig. 6 is 11001110000. For now, gatebitvector.
only consider the boxed bit vectors and ignore the smaller bit Clearly, we can repeat the aggregation process at multiple
vectorsbeloweachboxedbitvector. levels, forming a tree whose leaves are the bits in the original
Lucentbitvectorforafield.Thiscanbeusefulforlargeenough
Whenapacketheaderarriveswithfields ,wedo
.However,sincewedealwithaggregatesizesthatareatleast
a longest matching prefix lookup (or narrowest range lookup)
32,twolevelsofhierarchycanhandle rules.
ineachfield togetmatches andreadofftheresultingbit
Usinglargeraggregatesizeswillincreasethe thatcanbehan-
vectors fromthetriesforeachfield .Wethentakethein-
dledfurther.Thus,formuchofthispaper,wewillfocusonone
tersectionof forall ,andfindthelowestcostelementof
level(i.e.,asingleaggregatebitvector)ortwolevels(forafew
theintersectionset.Ifrulesarearrangedinnondecreasingorder
syntheticallygeneratedlargedatabases).Wenotethattheonly
ofcost,allweneedtodoistofindtheindexofthefirstbitsetin
reasonourresultsforsyntheticdatabasesarelimitedto20000
theintersectedbitvector.However,thesevectorshave bitsin
rulesisbecauseourcurrenttestingmethodology(tocheckthe
length;computingtheintersectionrequires operations.If
worstcasesearchtimeforallpacketheadercombinations)does
isthesizeofawordofmemorythanthesebitoperationsare
notscale.
responsiblefor memoryaccessesintheworstcase.
Notethattheworstcaseoccursverycommonlywhenapacket
3Ifthisisnotthecase,asiscommon,thenoursecondtechniqueofrearrange-
headerdoesnotmatchasingleruleinthedatabase. mentscanmakethisassumptionmoreapplicable.
6 IEEE/ACMTRANSACTIONSONNETWORKING,VOL.13,NO.1,FEBRUARY2005
However,noticethatforalltheonesintheaggregatebitvector
(exceptthelastone)thealgorithmwronglyassumesthatthere
mightbeamatchingruleinthecorrespondingbitpositions.
Thisisbecauseofwhatwecallafalsematch,asituationin
whichtheresultofanANDoperationonanaggregatebitreturns
aonebutthereisnovalidmatchinthegroupofrulesidentified
bytheaggregate.Thiscanclearlyhappenbecauseanaggregate
bitsetforfield1correspondingtopositions only
meansthatsomebitinthosepositions(e.g., , )hasa
bitset.Similarly,anaggregatebitsetforfield2corresponding
topositions onlymeansthatsomebitinthose
Fig. 7. Example of a database with two-dimensional rules for which the
positions(e.g., , )hasabitset.Thus,afalsematch
aggregationtechniquewithoutrearrangementbehavespoorly.Thesizeofthe
aggregateA = 2. occurswhenthetwoaggregatebitsaresetforthetwofieldsbut
. The worst case occurs when a false match occurs for
Why does aggregation help? The goal is to efficiently con- everyaggregatebitposition.
struct the bit map intersection of all fields without examining Forthisparticularexamplethereare30falsematcheswhich
alltheleafbitmapvaluesforeachfield.Forexample,suppose makesouralgorithmread31 2bitsmorethantheLucentbit
thatagivenpacketheadermatchesonlyasmallconstantnumber vector linear search algorithm. We have used an aggregation
ofrulesineachfield.Thiscanbedeterminedinconstanttime, size in our toy example, while in practice will be
evenforlarge ,byexaminingthetoplevelaggregatebitmaps; muchlarger.Notethatforlarger ,ouraggregatealgorithmwill
wethenonlyexaminetheleafbitmapvaluesforwhichtheag- onlyreadasmallnumberofbitsmorethantheLucentbitvector
gregatebitsareset.Thus,intuitively,weonlyhavetoexamine algorithmevenintheworstcase.
aconstantnumberofmemorywordsperfieldtodeterminethe
intersection because the aggregate vectors allow us to quickly C. WhyRearrangementofRulescanHelp
filter out bit positions where there is no match. The goal is to
Normally, in packet classification it is assumed that rules
haveaschemethatcomesclosetotaking memory
cannotberearranged.Ingeneral,ifRule1occursbeforeRule
accesses,evenforlarge .
2, and a packet could match Rule 1 and Rule 2, one must
Fig.6illustratestheconstructionfortheexampledatabasein
never rearrange Rule 2 before Rule 1. Imagine the disaster if
Fig.5usinganaggregatesize .Letusconsiderapacket
Rule 1 says “Accept,” and Rule 2 says “Deny,” and a packet
withField1startingwithbits0010andField2startingwithbits
thatmatchesbothrulesgetdroppedinsteadofbeingaccepted.
0100.FromFig.6onecanseethatthelongestprefixmatchis
Clearly, the problem is that we are rearranging overlapping
00forthefirstfieldand01forthesecondone.Theassociated
rules;tworulesaresaidtooverlapifthereisatleastonepacket
bit vectors are: 11001110000 and 01000011110 while the ag-
headerthatcanmatchbothrules.
gregateones(showninboldbelowtheregularbitvectors)are:
However, the results from [11] imply that in real databases
110and111. TheAND operationonthe twoaggregatevectors
ruleoverlapisrare.Thus,ifweknowthatapacketheadercan
yields 110, showing that a possible matching rule must be lo-
nevermatchRule1andRule2,thenitcannotaffectcorrectness
catedonlyinthefirst8bits.Thus,itisnotnecessarytoretrieve
to rearrange Rule 2 before Rule 1; they are, so to speak, “in-
theremaining4bitsforeachfield.
dependent”rules.Wecanusethisflexibilitytotrytogroupto-
Noticethatinthissmallexample,thecostsavings(assuming
getherrulesthatcontributetofalsematchesintothesameaggre-
awordsizeof4)isonlytwomemoryaccesses,andthisreduc-
gationgroups,sothatthememoryaccesscostoffalsematches
tion is offset by the two memory accesses required to retrieve
is reduced.
the bit maps. Larger examples show much bigger gains. Also,
Better still, we can rearrange rules arbitrarily as long as we
note that we have shown the memory accesses for one partic-
modifythealgorithmtofindallmatchesandthencomputethe
ular packet header. We need to efficiently compute the worst
lowestcostmatch.Forexample,supposeapacketmatchedrules
casenumberofmemoryaccessesacrossallpacketheaders.
Whileaggregationdoesoftenreducethenumberofmemory Rule 17, Rule 35, and Rule 50. Suppose after rearrangement
accesses,insomecasesaphenomenonknownasfalsematches Rule 50 becomes the new Rule 1, Rule 17 becomes the new
can increasethe numberof memoryaccessestobeing slightly Rule 3, and Rule 35 becomes the new Rule 6. If we compute
higher (because of the time toretrievethe aggregatesfor each allmatchesthepacketwillnowmatchthenewrules1,3,and6.
field)thaneventhenormalLucentbitvectorsearchtechnique. Supposewehaveprecomputedanarraythatmapsfromnewrule
ConsiderthedatabaseinFig.7andanaggregationsize ordernumbertooldruleordernumber(e.g.,from1to50,3to
. areallprefixeshavingthefirstfivebitsdifferent 17,etc.).Thus,intimeproportionaltothenumberofmatches,
fromthefirstfivebitsoftwoIPaddresses and .Assumethe wecanfindthe“oldruleordernumber”forallmatches,andse-
arrivalofapacketfromsource todestination .Thus,thebit lecttheearliestruleintheoriginalorder.Onceagainthecrucial
vectorassociatedwiththelongestmatchingprefixintheField1 assumption to make this efficient is that the number of worst
(source)trieis1010101 101andthecorrespondingbitvector caserulesthatmatchapacketissmall.Notealsothatitiseasy
in the Field 2 (destination) trie is 0101010 011. The aggre- (andnotmuchmoreexpensiveintheworstcase)tomodifyabit
gate bit vectors for both fields both using are 111 1. vectorschemetocomputeallmatches.
BABOESCUANDVARGHESE:SCALABLEPACKETCLASSIFICATION 7
theruledatabase;itconsistsofatriebuiltonallpossibleprefix
valuesthatarefoundinfield inanyruleintheruledatabase.
Thus, a node in trie is associated with a valid prefix
ifthereisatleastonerule intheclassifierhaving ,
where istheprefixassociatedwithfield ofrule .Foreach
suchnodetwobitvectorsareallocated.Thefirstonehas bits
andisidenticaltotheonethatisassignedintheBValgorithm.
Bit inthisvectorissetifandonlyifrule intheclassifier
has asaprefixof .Thesecondbitvectoriscomputedbased
onthefirstoneusingaggregation.Usinganaggregationsizeof
,abit inthisvectorissetifandonlyifthereisatleastone
Fig.8. ExampleofrearrangingthedatabaseinFig.7inordertoimprovethe
performanceofaggregation.ThesizeoftheaggregateA=2. rule , forwhich isaprefix
of .Theaggregatebitvectorhas bits.
When a packet arrives at a router, a longest prefix match is
Forexample,rearrangingtherulesinthedatabaseshownin
performed for each field of the packet header in trie to
thedatabaseinFig.7,weobtaintherearrangeddatabaseshown
yieldatrienode .Eachnode containsboththebitvector
inFig.8.Ifwereturntotheexampleofpacketheader( , ),
( )andtheaggregatevector( )spec-
thebitvectorsassociatedwiththelongestmatchingprefixinthe
ifyingthesetoffiltersorruleswhichmatchesprefix onthe
newdatabasewillbe111 11000 0and000 01111 1
dimension .Inordertoidentifythesubset offilterswhichare
havingthefirst31bits1inthefirstbitvectorandthelast31bits1
inthesecondbitvector.However,theresultoftheANDopera- a match for the incoming packet, the AND of is
firstcomputed.
tiononthe aggregatehasthe firstbitthatissetintheposition
16.Thismakesthenumberofbitsnecessarytobereadforthe Wheneverposition is1intheANDoftheaggregatevectors,
aggregateschemetobe whichislessthan thealgorithmperformsanANDoperationontheregularbitvec-
torsforeachchunkofbitsidentifiedbytheaggregatebit (bits
the number of the bits to be read for the scheme without re-
).Ifavalueof1isobtainedforbit
arrangement: .
, then the rule is part of set . However, the algorithm
The main intuition in Fig. 8 versus Fig. 7 is that we have
selectstherule withthelowestvalueof .
“sorted” the rules by first rearranging all rules that have in
Thus,thesimplestwaytodothisistocomputethematching
Field1tobecontiguous;havingdoneso,wecanrearrangethe
rulesfromthesmallestpositiontothelargest,andtostopwhen
remaining rules to have all values in Field 2 with a common
the first element is placed in . We have implemented this
valuetobetogether(thisisnotreallyneededinourexample).
scheme.However,inwhatfollowsweprefertoallowarbitrary
What this does is to localize as many matches as possible for
rearrangement of filters. To support this, we instead compute
thesortedfieldtoliewithinafewaggregationgroupsinsteadof
allmatches.Wealsoassumethateachruleisassociatedwitha
havingmatchesdispersedacrossmanygroups.
cost(thatcaneasilybelookedupusinganarrayindexedbythe
Thus,ourpaperhastwomajorcontributions.Ourfirstcontri-
rule position) that reflects its position before rearrangement.
butionistheideaofusingaggregationwhich,byitself,reduces
We only return the lowest cost filter, i.e., the filter with the
thenumberofmemoryaccessesbymorethananorderofmag-
smallest position number in the original database created by
nitude for real databases, and even for synthetically generated
the manager. As described earlier, this simple trick allows us
databaseswherethenumberoffalsematchesislow.Oursecond
to rearrange filters arbitrarily without regard for whether they
contributionistoshowhowcanonereducethenumberoffalse
intersectornot.
matchesbyafurtherorderofmagnitudebyusingrulerearrange-
Thepseudocodeforthisimplementationis:
menttogetherwithaggregation.Intherestofthispaper,wede-
scribeourschemesmorepreciselyandprovideexperimentalev-
idencethatshowstheirefficacy.
1 Get Packet ;
2 for to do
V. THEABVALGORITHM
3 ;
Inthissection,wedescribeournewABValgorithm.Westart 4 ;
bydescribingthealgorithmwithaggregationonly.Wethende- 5 for to do
scribethealgorithmwithaggregationandrearrangement. 6 ;
7 ;
A. AggregatedSearch
8 for to do
We start by describing more precisely the basic algorithm 9 if ( )
for a two-level hierarchy (only one aggregate bit vector), and 10 for to do
withoutrearrangementofrules. 11 if ( )
For the general -dimension packet classification problem 12 if ( )
our algorithm uses the rules of the classifier to precompute 13 ;
tries, , .Atrie isassociatedwithfield from 14 return BestRule;
8 IEEE/ACMTRANSACTIONSONNETWORKING,VOL.13,NO.1,FEBRUARY2005
B. ASortingAlgorithmforRearrangement that entries having the same prefix are now adjacent. The en-
tries having the same prefix then create subgroups; the proce-
Onecanseethatfalsematchesreducetheperformanceofthe
durecontinuesforeachsubgroupusingthenextfieldsthatneeds
algorithmintroducedintheprevioussection,withlines10to13
tobeconsidered;thealgorithmbelowconsidersfieldsinorder
inthealgorithmbeingexecutedmultipletimes.Inthissection,
from 1 to . Note that one could attempt to optimize by con-
we introduce a scheme which rearranges the rules such that,
sideringdifferentordersoffieldstosort.Wehavenotdoneso
whereverpossible,multiplefilterswhichmatchaspecificpacket
yetbecauseourresultsseemgoodenoughwithoutthisfurther
areplacedclosetoeachother.Theintent,ofcourse,isthatthese
degreeofoptimization.
multiplematchingfiltersarepartofthesameaggregationgroup.
A pseudocode description of the algorithm is given below.
Notethatthecodeofthelastsectionallowsustorearrangefilters
The algorithm is called initially by setting the parameters
arbitrarilyaslongasweretaintheircostvalue.
, ,
Recall that Fig. 8 was the result of rearranging the original
filter database from Fig. 7 by grouping together the entries
having asaprefixonthefirstfieldandthentheentrieshaving ARRANGE-ENT( )
as a prefix in the second field. After rearranging entries, 1 if(there are no more fields) or (
a query to identify the filter which matches the header ( , ) then return;
) of a packet takes about half the time it would take before 2 for (each valid size of prefixes) then
rearrangement. This is because regrouping the entries reduces 3 Group together all the elements with
thenumberoffalsematchestozero. the same size;
To gain some intuition into what optimal rule arrangement 4 Sort the previously created groups.
shouldlooklike,weexaminedfourreallifefirewalldatabases. 5 Create subgroups made up of elements
Wenoticedthattherewerealargenumberofentrieshavingpre- having the same prefixes on the field col
fixesofeitherlength0or32.Thissuggestsasimpleidea:ifwe 6 for (each subgroup with more than two
arbitrarilypickafieldandgrouptogetherfirsttheentrieshaving elements) then
prefixes of length 0 (such wildcard fields are very common), 7 Arrange-Ent( );
thentheprefixesoflength1,andsoonuntilwereachagroup
ofallsize32prefixes.Withineachgroupofsimilarlengthpre-
VI. AGGREGATED BIT VECTORS VERSUS BRIGG’S
fixes,wesortbyprefixvalue,therebygroupingtogetherallfil-
REPRESENTATIONFORSPARSESETS
ters with the same prefix value. For the field picked, this will
clearlyplaceallthewildcardfieldstogether,andallthelength Ref. [3] introduced an efficient way to represent sparse sets
32prefixestogether,andsoon.Intuitively,thisrulegeneralizes whichwedescribeinSectionII-A.Inthissection,weanalyti-
thetransformationfromFigs.7and8.Intherestofthepaper, callycomparethetwoschemes.
werefertothisprocessofrearrangementassortingonafield. Let bethewordsize, bethesizeofapointertoaposition
Suppose we started by sorting on field . There may be a in the dense vector in the Brigg’s scheme (e.g., probably 16
number of filters with prefix . Of course, we can continue bits to cover bitmaps of size greater than 256) and be the
thisprocessrecursivelyonsomeotherfield ,bysortingallen- numberofrules(calledsizeofuniversein[3]).Recallthatour
triescontainingentry usingthesameprocessonfield .This modelisdifferentfromBrigg’smodel:weonlycountmemory
clearlyleavesthesortingonfield unchanged. references.Thus,ifwereadawordwith6bitssetandhaveto
Our technique of moving the entries in the database creates chasedowneachbitset,thisoperationstillonlyhasacostof1.
largeareasofentriessharingacommonsubprefixinoneormore This is because hardware (and even software) logic operating
fields.Ifthereareentrieshavingfieldssharingacommonsub- onregistersismuchfasterthanamemoryaccess.
prefixwithdifferentlengths,itseparatesthematacomfortable Wefirstinvestigatethetimecomplexityofasearchoperation.
distancesuchthatfalsematchesarereduced. Lemma 6.1: There exists rule sets (moderately dense) for
Aquestioneachrearrangementschemeshouldaddressiscor- whichtheBrigg’srepresentationtakesafactorof more
rectness.Inotherwords,foranypacket andanyfilterdatabase memory accesses than ABV, where is a small constant no
which,afterrearrangementistransformedintoadatabase , greaterthan4.
theresultofthepacketclassificationproblemhavingasentries Forexample,with (typicalwordsize)and ,
both( , )and( , )shouldbethesame.Onecanseethat thereareexecutionswhereABVis256timesfasterthanusing
theABValgorithmguaranteesthisbecauseanentryisselected Brigg’srepresentation.
basedonitscost.Notethat(bycontrast)intheBVschemean Proof: Consider a case in which we are intersecting two
entryisselectedbasedonitspositionintheoriginaldatabase. 64-bitvectors and .(Thecasemaybegeneralizedforother
Our rearranging scheme uses a recursive procedure which valuesof ) hasitsfirst32bitssetwhile hasthenext32
considerstheentriesfromasubsectionoftheoriginaldatabase bitsset.Thereforetheirintersectionisnull. Byusingaggrega-
identifiedthroughthefirstandlastelement.Therearrangement tion withan aggregatesize equal to 32, ABV gives an answer
is based on the prefixes from the field col provided as an ar- using only two memory accesses, reading the two aggregates
gument. The procedure groups the entries based on the length and intersecting them. Let us consider next two bit vectors
oftheprefixes;forexamplefirstitconsiderstheprefixesfrom , . hasthefirsthalfofitsbitsset,while hasthesecond
field1,andcreatesanumberofgroupsequaltothenumberof halfset.Thesetstheydesignatearedisjoint.ABVproducesan
differentprefixlengthsinfield1.Eachgroupisthensortedso answer using accesses, while using Brigg’s
BABOESCUANDVARGHESE:SCALABLEPACKETCLASSIFICATION 9
representationtheanswerrequiresreading words. mensionwehaveobservedmultiplematchesbecauseoflotsof
Weconsider .4 wildcards.
Lemma 6.2: There is no execution on which ABV is more Thereforetheresultsetineachdimensionisnotsparse;thus
thanafactor timesworsethanusingBrigg’srep- it does not favor the use of Brigg’s representation. It is very
resentation. commontohaveabout20%matchingrulesineachdimension,
Theworstcaseexecutionsoccurwhenthebitvectorissparse. becauseofalargenumberofzerolength(wildcarded)prefixes.
For example, with and (pretty much the AsaresultweconcludethatABVisabettersolutionformulti-
largestsizesoneshouldconsiderandconsideredinourpaper), dimensionalpacketclassification.
thismeansthattheBrigg’smethodcanbeatABVbyatmosta
factor of 2. Notice that for larger , easily achieved in hard- VII. EVALUATION
ware,thecomparisonfavorsABVfurther.
InthissectionweconsiderhowtheABValgorithmcanbeim-
Proof: If ABV examines a word in the sparse bitmap, it
plemented,andhowitperformsonbothrealfirewalldatabases
must be that both aggregate bits indicate a 1, so both bitmaps
andsyntheticallycreateddatabases.Notethatweneedsynthet-
haveanonzeropositioninthatword,sousingBrigg’srepresen-
icallycreateddatabasestotestthescalabilityofourschemebe-
tationmustpaytwomemoryaccessesasABVdoes.Thus,ABV
causerealfirewalldatabasesarequitesmall.
canonlypaymoreaccessesbyreadingtheaggregates.However
First,weconsiderthecomplexityofthepreprocessingstage
foreverybitset(apositionthatmustbeexaminedusingBrigg’s
and the storage requirements of the algorithm. Then, we con-
representation)ABVpaysatmost memoryaccesses
siderthequeryperformanceandwerelateittotheperformance
(ignoringtherootwhichisanextra1thatcancelswiththescalar
of the BV algorithm. The speed measure we use is the worst
fieldinBriggs).
casenumberofmemoryaccessesforsearchacrossallpossible
Corollary 6.3: For and , ABV is never
packet headers. This number can be computed without con-
more than a factor of two worse than Brigg’s representation,
sidering all possible packets because packet headers fall into
whileusingBrigg’srepresentationcanbe256timesworsethan
equivalenceclassesbasedondistinctcrossproducts[20];adis-
using ABV.
tinctcross-productisauniquecombinationoflongestmatching
The following lemmas investigate the memory occupied by
prefixvaluesforeachheaderfield.
bothimplementation:ABVandtheonebasedonBrigg’srepre-
Sinceeachpacketthathasthesamecross-productismatched
sentation.Weconsiderfirstthesituationinwhichtherulesetis
to the same node (in trie ) for each field , each packet
dense.AswewillseeintheSectionVIIitisquitecommonto
thathasthesamecross-productwillbehaveidenticallyinboth
havesetswhichcontainmorethan20%ofthetotaluniverse.
the BV and ABV schemes. Thus, it suffices to compute worst
Lemma6.4: Thereexistsrulesets(verydense)forwhichthe
case search times for all possible cross-products. However,
Brigg’srepresentationtakesafactorof16morememory(using
computing all crossproducts for a database of 20000 rules
16bitpointerswheneverybitisset)thanABV.
took 6 hours on a modern SPARC. We improved the testing
Proof: Immediate,consideringthatthedensevectorcon-
algorithm from hours to minutes using a clever idea used in
tains pointers which are represented using bits. In this case
the RFC scheme [11] to equivalence cross-products while
. computing crossproducts pairwise.Note that these large times
Lemma6.5: ThereexistsnorulesetforwhichABVismore arethetimesrequiredtocertifytheworstcasebehaviorofour
than a factor of worse in memory size than using algorithm,notthetimeforasearch.
Brigg’srepresentation. We have seen that false matches can cause our ABV algo-
Proof: Consider the case in which there is only one ele- rithm(intheory)tohaveapoorerworstbehaviorthanBV.How-
ment inthe set. For this case using Brigg’srepresentation one everthroughourexperimentsweshowthatABVoutperformsBV
only needs to store a pointer to that element. However, ABV bymorethananorderofmagnitudeonbothreallifedatabases
paysforstoringtheaggregate.Theoverallsizeoftheaggregate andsyntheticdatabases.
is . Therefore the overall memory space occupied
by ABV is while using Brigg’s repre- A. ABVPreprocessing
sentationthememorysizeis .
Weconsiderthegeneralcaseofa dimensionclassifier.We
Corollary 6.6: For , using Brigg’s representation
build tries , ,oneforeachdimension.Eachtrie
canbe16timesworseinstoragethan,whileforanydatabase
hastwodifferenttypesofnodesdependingiftheyareassociated
of rules using ABV uses at most 3% more memory than using
ornotwithvalidprefixes.Thetotalnumberofnodesinthetries
Brigg’srepresentation.
isontheorderof ,where isthenumberofentries
So,whichoftherepresentationsshouldbeusedforthemulti-
in the classifier (i.e., rule database). Two bit vectors are asso-
dimensionalpacketclassificationproblem?Theauthorsin[11]
ciated with each valid prefix node. One bit vector is identical
noticed that despite an increase in the number of rules in the withtheoneusedinBVschemeandrequires
packetclassification,thereareonlyasmall,limitednumberof wordsofdata.Thesecondbitvectoristheaggregateofthefirst
matching rules.Therefore in a set representation one can only one;itcontains bitsofdatawhichmeansthatitrequires
saythattheresultsetissparse.However,ineachindividualdi- wordsofmemory( isthesizeofthe
aggregate). Building both bit vectors requires an pass
4Thisexamplealsosuggestswhyrearrangementhelps.Itallowsustopay
throughtheruledatabaseforeachvalidnodeofthetrie.Thus,
acostofonlyonememoryaccesstolookatanaggregatepointingtoaword
containinglotsof1’sthatwedonotneedtoexamine. thepreprocessingtimeis .
10 IEEE/ACMTRANSACTIONSONNETWORKING,VOL.13,NO.1,FEBRUARY2005
Fig.9. Sizesofthefirewalldatabasesweuseintheexperiments.
Fig.10. Prefixlengthdistributionintheroutingtables,September12,2000.
Onecaneasilyseefromherethatthememoryrequirements
for ABV are slightly higher than that of BVS; however for an times:ineachstep,werandomlypickasourceprefixandades-
aggregatesizegreaterthan32(e.g.,software),ABVdiffersfrom tinationprefixfromanyofthefiveroutingtables.Thisgenera-
BV by less than 3%, while for an aggregate size of 500 (e.g., tiontechniqueisunrealisticbecauserealroutingdatabaseshave
hardware),itisbelow0.2%. at most one prefix of length 0. Thus, simple random genera-
The time required for insertion or the deletion of a rule in tionisveryunlikelytogenerateruleswithzerolengthprefixes,
ABVisofthesamecomplexityasBV.Thisisbecausetheag- whereas zero length prefixes are very common in real firewall
gregatebitvectorisupdatedeachtimetheassociatedbitvector ruledatabases.
isupdated.Notethatupdatescanbeexpensivebecauseadding For more realistic modeling, we also allow a controlled in-
a filter with a prefix can potentially change the bit maps of jectionofruleswithzerolengthprefixes,wheretheinjectionis
severalnodes.However,inpracticeitisraretoseemorethana controlledbyaparameterthatdeterminesthepercentageofzero
fewbitmapschange,possiblybecausefilterintersectionisquite lengthprefixes.Forexample,iftheparameterspecifiesthat20%
rare [11]. Thus, incremental update, though slow in the worst oftheruleshaveazerolengthprefix,theninselectingasource
case,isquitefastontheaverage. ordestinationfieldforarule,wefirstpickarandomnumberbe-
tween0and1;ifthenumberislessthan0.2wesimplyreturn
B. ExperimentalPlatform
thezerolengthprefix;else,wepickaprefixrandomlyfromthe
Weusedtwodifferenttypesofdatabases.Firstweusedaset specifiedroutingtable.
offourindustrialfirewalldatabases.Forprivacyreasonsweare A similar construction technique is also used in [8] though
notallowedtodisclosethenameofthecompaniesortheactual they limit wild card injection to 20%, while our experiments
databases.Eachentryinthedatabasecontainsa5-tuple(source haveusedupto50%wildcardinjection.[8]alsousesanother
IPprefix,destinationIPprefix,sourceportnumber(range),des- technique based on extracting all pairs of source-destination
tinationportnumber(range),protocol).Wecallthesedatabases
prefixes from traces and using these as filters. They show that
. The database characteristics are presented in
thetwomethodsdifferconsiderablywiththerandomselection
Fig. 9.
method providing betterresults because the trace methodpro-
The third and fourth field of the database entries are repre-
ducesmoreoverlappingprefixpairs.However,ratherthanusing
sented by either port numbers or range of port numbers. We
an ad hoc trace, we prefer to stress ABV further by adding a
convertthemtovalidprefixesusingthetechniquedescribedin
controlledinjectionofgroupsofprefixesthatshareacommon
[20].Thefollowingcharacteristicshaveimportanteffectsonthe
prefixtoproducemoreoverlappingprefixpairs.
resultsofourexperiments.
When we inject a large amount of zero length prefixes and
1) Most prefixes have either a length of 0 or 32. There are
subprefixes, we find that ABV without rearrangement begins
someprefixeswithlengthsof21,23,24and30.
to do quite poorly, a partial confirmation that we are stressing
2) No prefix contains more than four matching subprefixes
thealgorithm.Fortunately,ABVwithrearrangementstilldoes
foreachdimension.
verywell.Finally,wedidsomelimitedtestingonsyntheticfive-
3) The destination and source prefix fields in roughly half
dimensionaldatabases.Wegeneratedthesourceanddestination
theruleswerewildcarded(bycontrast,[8]onlyassumes
fieldsofrulesasinthesynthetictwo-dimensionalcase;forthe
at most 20% of the rules have wildcards in their exper-
remainingfields(e.g.,ports)wepickedportnumbersrandomly
iments), and roughly half the rules have in the
according tothe distributionfound inour largerreal database.
port number fields. Thus, the amount of overlap within
Onceagain,wefindthatABVscalesverywellcomparedtoBV.
eachdimensionwaslarge.
4) Nopacketmatchesmorethanfourrules.
C. PerformanceEvaluationonIndustrialFirewallDatabases
The second type of databases are randomly generated two
and five field (sometimes called two- and five-dimensional) WeexperimentallyevaluateABValgorithmonfourindustrial
databases using random selection from five publicly available firewalldatabasesdescribedinFig.9.Therulesinthedatabases
routingtables([13]).Weusedthesnapshotofeachtabletaken areconvertedintoprefixformatusingthetechniquedescribedin
on September 12, 2000. An important characteristic of these [17].Thememoryspacethatisusedbyeachofthemcanbeesti-
tablesistheprefixlengthdistribution,describedinFig.10. matedbasedonthenumberofnodesinthetries,andthenumber
Recall that the problem is to generate a synthetic database ofnodesassociatedwithvalidprefixes.Weprovidethesevalues
thatislargerthanoursampleindustrialdatabasestotestABV in Fig. 11. A node associated with a valid prefix carries a bit
forscalability.Thesimplestwaytogenerateatwo-dimensional vectorofsizeequalto wordsandanaggregatebitvector
classifier of size would be to iterate the following step ofsize words.Weusedawordsizeequalto32;
