TCAM Razor: A Systematic Approach Towards Minimizing Packet Classifiers in TCAMs

Abstract

Abstract-Packet classification is the core mechanism that enables many networking services on the Internet such as firewall packet filtering and traffic accounting. Using Ternary Content Addressable Memories (TCAMs) to perform high-speed packet classification has become the de facto standard in industry. TCAMs classify packets in constant time by comparing a packet with all classification rules of ternary encoding in parallel.Despite their high speed, TCAMs suffer from the well-known prefix expansion problem. As packet classification rules usually have fields specified as intervals, converting such rules to TCAMcompatible rules may result in an explosive increase in the number of rules. This is not a problem if TCAMs have large capacities. Unfortunately, TCAMs have very limited capacity, and more rules means more power consumption and more heat generation for TCAMs. Even worse, the number of rules in packet classifiers have been increasing rapidly with the growing number of services deployed on the internet.To address the prefix expansion problem of TCAMs, we consider the following problem: given a packet classifier, how can we generate another semantically equivalent packet classifier that requires the least number of TCAM entries? In this paper, we propose a systematic approach, the TCAM Razor, that is effective, efficient, and practical. In terms of effectiveness, our TCAM Razor prototype achieves a total compression ratio of 3.9%, which is significantly better than the previously published best result of 54%. In terms of efficiency, our TCAM Razor prototype runs in seconds, even for large packet classifiers. Finally, in terms of practicality, our TCAM Razor approach can be easily deployed as it does not require any modification to existing packet classification systems, unlike many previous prefix expansion solutions.

A safe, efficient update protocol for openflow networks

“…Optimization of TCAM space is a subject of considerable interest. See, for example, [10][12], among many others. In this paper, we conserve switch rulespace.…”

On the Update Problems for Software Defined Networks

“…Наш вклад в ее изучение представлен тремя основными результатами. Мы предложили усовершенствованную абстрактную модель SDN, пригодную для формализации многочисленных вариантов NUP, которые рассматривались в ста-тьях [10,11,12,13,14,15]. В рамках предложенной модели SDN мы сформулиро-вали задачу восстановления конфигураций и установили достаточные условия, при которых ее можно решить, не прибегая к тегированию пакетов.…”

“…В статье [11] показано, что корректное глобальное реконфигурирование можно осуществить при помощи универсального трехфазного алгоритма с использованием пометок (тегов) в специально выделенных для этой цели полях заголовков пакетов (например, в полях VLAN). Исследование других вариантов NUP проводилось в работах [13] (синтез сетевых конфигураций) и в [14,15] (оптимизация таблиц коммутации).…”

Multi-match Packet Classification Scheme Combining TCAM with an Algorithmic Approach

“…However, the multi-match classification concept is becoming a major research item because of the increasing need for network security from systems such as network intrusion detection or worm detection, or in new application programs, such as load balancing and packet-level accounting [5][6][7][8][9][10][11][12][13][14]. As a network intrusion detection system (NIDS) example, a packet may match multiple rule headers, and related rule options for all the matching rule headers need to be identified in order to be checked later.…”

“…TCAM also costs about 30 times more per bit of storage than double data rate (DDR) SRAM. TCAM's power consumption is directly related to the number of TCAM accesses, and grows linearly with the number of entries searched in parallel [12]. In order to be energy-and cost-efficient, TCAM-based solutions must use an economic TCAM size and perform a limited number of TCAM lookups for each packet.…”