Accelerating Packet Classification via Direct Dependent Rules

Abstract

Packet classification is used to determine the behavior of incoming packets in network devices. The development of algorithms for packet classification that can be applied in a widespread manner to firewalls is required, given the prevalence of Internet threats and the need for effective communication. As it is achieved using linear search on a classification rule list, a large number of rules leads to longer communication latency. To decrease the latency, a problem known as optimal rule ordering (ORO) has been formalized, which aims to identify the ordering of rules that minimizes the classification latency caused by packet classification, while preserving the classification policy.Because ORO is known to be NP–hard, various heuristics for ORO have been proposed.Certain algorithms with time complexities of O(n2) exist that cannot sufficiently reduce the latency. Algorithms that can reduce the latency have time complexities of O(n3).To decide the position where rules should be placed, most heuristic algorithms for ORO calculate evaluations that take into account of packets that match the rule and the constraints of reordering. This calculation is the bottleneck of time complexities for reordering algorithms, and there is a trade-off relationship with the reordering accuracy. Thus in this paper, we propose O(n2) method that uses the average number of not only the rule to be evaluated but also the rules that are depended by it. Furthermore, we demonstrate the effectiveness of our method by comparing it with other O(n2) methods using ClassBench, which is a benchmark for packet classification algorithms.