A method and apparatus for packet classification

Abstract

In one aspect, the present invention reduces the amount of low-latency memory needed for rules-based packet classification by representing a packet classification rules database in compressed form. A packet processing rules database, e.g., an ACL database comprising multiple ACEs, is preprocessed to obtain corresponding rule fingerprints. These rule fingerprints are much smaller than the rules and are easily accommodated in on-chip or other low-latency memory that is generally available to the classification engine in limited amounts. The rules database in turn can be stored in off-chip or other higher-latency memory, as initial matching operations involve only the packet key of the subject packet and the fingerprint database. The rules database is accessed for full packet classification only if a tentative match is found between the packet key and an entry in the fingerprint database. Thus, the present invention also advantageously minimizes accesses to the rules database.

Description

technical field [0001] The present invention relates generally to data networks, and in particular, to packet classification in data networks. Background technique [0002] Access Control Lists (ACLs) are a common method used to filter IP traffic. An ACL includes a list of rules called Access Control Entries (ACEs). In one example scenario, an ACE maps incoming packets to outgoing ports as a function of source and destination addresses, and indicates whether a given incoming packet should be allowed (routed) or rejected (discarded). Of course, ACLs can also be used for other purposes, including network address translation (NAT) processing, policy-based routing, and more. [0003] As the "intelligence" of IP networks (such as those implemented in the latest telecommunications networks) increases, more sophisticated packet classification, security filtering, policy routing, packet redirection for service chaining, OpenFlow handles switching, etc. "OpenFlow" is an open inte...

AI Technical Summary

Problems solved by technology

However, MRFC-based solutions typically require many external memory accesses, since the large amount of memory required in MRFC processing is usually not suitable for use as on-chip memory of the routing engine's digital processor

Another problem is that MRFC also doesn't seem to work with the wider group "keys" that are becoming more common as IPv6 usage increases

Images