Hardware-Assisted Patricia Trees for Lossless Packet Filtering

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Packet capture filters, particularly Berkeley packet filters (BPF), face challenges in high-bandwidth networks like 10 Gbps or greater, where they often result in packet loss due to their inability to process data at line-rate without dropping packets.

Innovation Solution

Converting PCAP-style filters into a disjunctive normal form (DNF) and inserting them into hardware-assisted Patricia trees, which allows for lossless filtering at rates up to 40 Gbps by leveraging specialized processors like the NP-X line from EZchip Technologies, while overcoming limitations such as limited key size and non-overlapping filter support.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If BPF filters are used in high-bandwidth networks, then filtering flexibility is maintained, but packet loss occurs due to inability to process at line-rate

Engineering Contradiction:

Improvefiltering flexibilityVSAvoidpacket loss

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent replaces the software-based BPF filtering mechanism with a hardware-based Patricia tree structure implemented in specialized processor circuits. This substitution enables line-rate packet processing by moving the filtering logic from general-purpose CPU execution to dedicated hardware circuits that can operate at wire speed without packet loss.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The patent introduces a specialized processing layer (hardware-assisted Patricia tree processor) that acts as an intermediary between the network interface and higher-layer processing. This intermediate hardware component performs filtering at line-rate before packets reach software processors, preventing packet loss while maintaining filtering flexibility through the Patricia tree structure.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Productivity

If hardware-assisted Patricia trees are used for line-rate filtering, then packet processing speed increases to 40 Gbps, but filter expression complexity increases due to DNF conversion requirements

Engineering Contradiction:

Improvepacket processing speedVSAvoidfilter expression complexity

Core Design Contradiction:

ProductivityVSDevice complexity

Solution Approach 1:

The patent applies Disjunctive Normal Form (DNF) conversion to filter expressions as a preliminary step before inserting them into the hardware Patricia tree structure. By pre-processing and normalizing filter expressions into DNF format, the system prepares them in advance to match the hardware structure's requirements, enabling efficient line-rate processing without runtime complexity.

Inventive Principle:

Principle #10Preliminary action

3Reliability

If PCAP filters are converted to DNF for hardware insertion, then lossless filtering at 40 Gbps is achieved, but the number of filters is limited by tree key size constraints

Engineering Contradiction:

Improvelossless filteringVSAvoidnumber of filters

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent segments the filtering functionality across multiple hardware-assisted Patricia tree structures when necessary. By dividing the filter set into multiple trees, each managing a subset of filters within key size constraints, the system maintains lossless filtering capability while increasing the total number of supported filters beyond what a single tree could handle.

Inventive Principle:

Principle #1Segmentation

Data Source

PatentEP2487861B1Lossless real-time line-rate filtering using PCAP style filters and hardware assisted patricia trees

Publication Date: 2017.12.13 NETSCOUT SYSTEMS TEXAS LLC

Figure 1~2
Figure 3

AI summary

A processor performs line-rate filtering using hardware-assisted Patricia trees. A PCAP-style filter is converted into a form that can be inserted into a Patricia tree. The PCAP filter expression is parsed and converted into disjunctive normal form (DNF). Each DNF clause of the filter is inserted into a Patricia tree. The DNF clauses are checked for overlaps and the overlapping clauses are combined when possible.