Co-match: fast and efficient packet inspection for multiple flows

Abstract

Packet inspection is widely employed in application-layer protocol analyzing systems to enable accurate protocol identification. Many existing systems, however, fail to meet the requirement of keeping up with wire speed in networking. There are two limitations: (1) software-based matching schemes are usually in a sequential manner which is slow and inefficient; (2) fast hardware-based matching schemes are inapplicable to network packet processing for lacking of intrinsic support for multiple flows. This paper proposes a novel approach for application-layer protocol identification called Co-Match, which combines software and hardware together to achieve fast and efficient signature matching for multiple flows. First, a grouping scheme is adopted to organize signatures into several matching sets. With this scheme, each packet is only matched against a subset of signatures, bringing about a remarkable improvement of matching speed in software. Second, an FPGA-based coprocessor is developed in order to support fast parallel regular expression matching for multiple flows in hardware. Moreover, a hardware-based flow-level traffic load balancer is employed to parallel multi-flow processing on multiple CPU cores. Experimental results show that our approach is efficient to handle multiple flows while system throughput can achieve the wire speed of Gigabit Ethernet links with moderate CPU usage.