NIC Packet Filtering via Field Vector Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network packet filtering methods require significant processor cycles for classification and often rely on expensive hardware filters, such as TCAM, to differentiate between control and data plane packets, which is inefficient.
Innovation Solution
A network interface controller (NIC) is configured to extract data fields from incoming network packets and populate a field vector, which is then used to compare against a matching list of rules to determine the appropriate action, reducing the need for expensive hardware filters and minimizing processor cycles.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If software-based packet classification is used, then device complexity is reduced, but processor cycles and processing time increase significantly
Solution Approach 1:
The patent replaces software-based packet classification (mechanical processing) with hardware-based classification using classification circuitry integrated into the NIC. This substitution moves the filtering function from the processor domain to the hardware domain, achieving both reduced processor cycles and maintained low device complexity at the host system level.
2Speed
If TCAM hardware filters are used, then packet classification speed improves, but hardware cost and device complexity increase
Solution Approach 1:
The patent replaces expensive TCAM hardware with more cost-effective standard logic circuitry and memory resources available in modern NICs. The classification is achieved using combinational logic and standard memory structures that are significantly cheaper than TCAM while providing sufficient performance for the filtering requirements.
Solution Approach 2:
The patent utilizes existing multi-functional NIC resources (standard logic units, memory structures, and processing elements) to perform packet classification, rather than adding dedicated specialized hardware. This approach achieves high-speed filtering using components that serve multiple functions within the NIC architecture.
3Measurement precision
If multiple hardware filters are deployed, then filtering accuracy improves, but cost and device complexity increase exponentially
Solution Approach 1:
The patent combines multiple filtering criteria and classification rules into a single integrated classification circuitry unit within the NIC. Rather than deploying multiple separate hardware filters, the design merges all filtering logic into one unified hardware structure that processes packets through a single pass, achieving high accuracy without exponential complexity growth.
Solution Approach 2:
The patent transforms the filtering approach by moving from multiple sequential filter stages to a parallel hardware evaluation model where multiple classification rules are evaluated simultaneously in a single hardware pass. This dimensional change from sequential to parallel processing achieves comprehensive filtering accuracy without increasing system complexity.
Data Source
AI summary
Technologies for filtering network traffic on ingress include a network interface controller (NIC) configured to parse a header of a network packet received by the NIC to extract data from a plurality of header fields of the header. The NIC is additionally configured to determine an input set based on the field vector, retrieve a matching list from a plurality of matching lists, and compare the input set to each of the plurality of rules to identify a matching rule of the plurality of rules that matches a corresponding portion of the input set. The NIC is further configured to perform an action on the network packet based on an actionable instruction associated with the one of the plurality of rules that matches the corresponding portion of the input set. Other embodiments are described herein.