High-speed policy-based packet forwarding using efficient multi-dimensional range matching

Lakshman, T. V.; Stiliadis, D.

doi:10.1145/285243.285283

Cited by 257 publications

(142 citation statements)

References 14 publications

(1 reference statement)

Supporting

Mentioning

141

Contrasting

Unclassified

Order By: Relevance

“…We encountered this problem in the context of networking while trying to design fast IP lookup schemes [6], [11]. In IP lookup, the time-consuming task at hand is prefix lookup, and the processors are arranged (often within a custom chip) as a pipeline.…”

Section: Introductionmentioning

confidence: 99%

Parallelism versus memory allocation in pipelined router forwarding engines

Chung

Graham

Varghese

2004

Proceedings of the Sixteenth Annual ACM Symposium on Parallelism in Algorithms and Architectures

View full text Add to dashboard Cite

Abstract.A crucial problem that needs to be solved is the allocation of memory to processors in a pipeline. Ideally, the processor memories should be totally separate (i.e., one-port memories) in order to minimize contention; however, this minimizes memory sharing. Idealized sharing occurs by using a single shared memory for all processors but this maximizes contention. Instead, in this paper we show that perfect memory sharing of shared memory can be achieved with a collection of two-port memories, as long as the number of processors is less than the number of memories. We show that the problem of allocation is NP-complete in general, but has a fast approximation algorithm that comes within a factor of 3 2 asymptotically. The proof utilizes a new bin packing model, which is interesting in its own right. Further, for important special cases that arise in practice a more sophisticated modification of this approximation algorithm is in fact optimal. We also discuss the online memory allocation problem and present fast online algorithms that provide good memory utilization while allowing fast updates.

show abstract

Section: Introductionmentioning

confidence: 99%

Parallelism versus memory allocation in pipelined router forwarding engines

Chung

Graham

Varghese

2004

Proceedings of the Sixteenth Annual ACM Symposium on Parallelism in Algorithms and Architectures

View full text Add to dashboard Cite

show abstract

“…An interesting approach that relies on very wide memory accesses is presented by Lakshman et al [6]. The scheme computes the best matching prefix for each of the k fields of the filter set.…”

Section: Related Workmentioning

confidence: 99%

Fast packet classification for two-dimensional conflict-free filters

Baboescu¹,

Warkhede²,

Suri³

et al. 2006

Computer Networks

View full text Add to dashboard Cite

Routers can use packet classification to support advanced functions such as QoS routing, virtual private networks and access control. Unlike traditional routers, which forward packets based on destination address only, routers with packet classification capability can forward packets based on multiple header fields, such as source address, protocol type, or application port numbers. The destination-based forwarding can be thought of as one-dimensional packet classification.While several efficient solutions are known for the one-dimensional IP lookup problem, the multi-dimensional packet classification has proved to be far more difficult. While an O(log w) time scheme is known for the IP lookup, Srinivisan et al. [V. Srinivasan, S. Suri, G. Varghese, Packet classification using tuple space search, in: Proceedings of SIGCOMMÕ99, 1999] show a lower bound of X(w kÀ1 ) for k-dimensional filter lookup, where w is the number of bits in a header field. In particular, this lower bound precludes the possibility of a binary search like scheme even for two-dimensional filters (say, IP source and destination pairs).In this paper, we examine this lower bound more closely, and discover that the lower bound depends crucially on conflicts in the filter database. We then show that for two-dimensional conflict-free filters, a binary search scheme does work! Our lookup scheme requires O(log 2 w) hashes in the worst case, and uses O(n log 2 w) memory. Alternatively, our algorithm can be viewed as making O(log w) calls to a prefix lookup scheme.It has been observed in practice that filter databases have very few conflicts, and these conflicts can be removed by adding additional filters (one per conflict). Thus, our scheme may also be quite practical. Our simulation and experimental results show that the proposed scheme also performs as good as or better than existing schemes. For example, on real firewall data sets with over 200 rules consisting of source and destination IP prefixes, our algorithm performs worst case 12 hashes. For filter sets containing arbitrarily many filtering rules with IP prefixes, the worst case search time guaranteed is utmost 25 hashes.

show abstract

“…Current solutions [51,66,96,97] work well only for a relatively small number of classes, i.e., no more than several thousand. This is because, as noted by Gupta and McKeown [51], the packet classification problem is similar to the point location problem in the domain of computation geometry.…”

Section: Routing Lookupmentioning

confidence: 99%

Stateless Core: A Scalable Approach for Quality of Service in the Internet

Stoica¹,

Zhang²

2004

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Today's Internet provides one simple service: best effort datagram delivery. This minimalist service allows the Internet to be stateless, that is, routers do not need to maintain any fine grained information about traffic. As a result of this stateless architecture, the Internet is both highly scalable and robust. However, as the Internet evolves into a global commercial infrastructure that is expected to support a plethora of new applications such as IP telephony, interactive TV, and e-commerce, the existing best effort service will no longer be sufficient. In consequence, there is an urgent need to provide more powerful services such as guaranteed services, differentiated services, and flow protection.Over the past decade, there has been intense research toward achieving this goal. Two classes of solutions have been proposed: those maintaining the stateless property of the original Internet (e.g., Differentiated Services), and those requiring a new stateful architecture (e.g., Integrated Services). While stateful solutions can provide more powerful and flexible services such as per flow bandwidth and delay guarantees, they are less scalable than stateless solutions. In particular, stateful solutions require each router to maintain and manage per flow state on the control path, and to perform per flow classification, scheduling, and buffer management on the data path. Since today's routers can handle millions of active flows, it is difficult, if not impossible, to implement such solutions in a scalable fashion. On the other hand, while stateless solutions are much more scalable, they offer weaker services.The key contribution of this dissertation is to bridge this long-standing gap between stateless and stateful solutions in packet switched networks such as the Internet. Our thesis is that "it is actually possible to provide services as powerful and as flexible as the ones implemented by a stateful network using a stateless network". To prove this thesis, we propose a novel technique called Dynamic Packet State (DPS). The key idea behind DPS is that, instead of having routers maintain per flow state, packets carry the state. In this way, routers are still able to process packets on a per flow basis, despite the fact that they do not maintain any per flow state. Based on DPS, we develop a network architecture called Stateless Core (SCORE) in which core routers do not maintain any per flow state. Yet, using DPS to coordinate actions of edge and core routers along the path traversed by a flow allows us to design distributed algorithms that emulate the behavior of a broad class of stateful networks in SCORE networks.In this dissertation we describe complete solutions including architectures, algorithms and implementations which address three of the most important problems in today's Internet: providing guaranteed services, differentiated services, and flow protection. Compared to existing solutions, our solutions eliminate the most complex operations on both the data and control paths in the network core, i...

show abstract

High-speed policy-based packet forwarding using efficient multi-dimensional range matching

Cited by 257 publications

References 14 publications

Parallelism versus memory allocation in pipelined router forwarding engines

Parallelism versus memory allocation in pipelined router forwarding engines

Fast packet classification for two-dimensional conflict-free filters

Stateless Core: A Scalable Approach for Quality of Service in the Internet

Contact Info

Product

Resources

About