A multi-dimensional packet classifier for NP-based firewalls

Abstract

In this paper we present design and implementation of a new multi-dimensional packet classifier engine using network processor technology. Our classification algorithm is fast and is based on hierarchical trie search for multi-dimensional rules. Moreover, we propose a technique to optimize the memory usage of our classifier. We have used the Intel/spl reg/ IXP1200 network processor pipeline architecture for implementation of the classifier. The final system is targeted to be a fast firewall packet filtering engine that uses the filtering policies as its classification rules. Our experimental result shows that the packet classification throughput results for various distribution of packet sizes, is above 800Mbps.