Split-TCAM mechanism for storing patterns efficiently

Abstract

TCAM-based payload inspection algorithms for detecting viruses and worms wasted much memory for storing redundant bytes, "don't care". The aim of our research was to eliminate the redundancy so as to store more rules in TCAM or reduce the area cost. To eliminate the redundancy, we devised Split-TCAM mechanism where a TCAM block is split into every byte. We simulated our Split-TCAM mechanism using Snort v2.8.5 [1]. Results indicated that the proposed mechanism could save the required size of memory to 37.4% and 27.7% on average when applying it to the R-TCAM and Jumping Window algorithm, respectively.