1 Space-Efficient TCAM-based Classification Using Gray Coding Anat Bremler – Barr Interdisciplianry Center Danny Hendler Ben-Gurion University Infocom paper presentation

2 Talk outline Definitions Problem definition, prior art The Short Range Gray Encoding Algorithm Experimental results Future work

3 Packet Classification

4 ACL ID Source addr Source port Dest addr Dest port Protocol Action ACL *.*.* 80 TCP Allow ACL *.*.* UPD Allow ACL ≤ ≤ 1024 TCP Deny ACL UDP Log ACL *.*.* 25 TCP Deny ACL > TCP Allow ACL > TCP Log ACL database f headerpayload search key

5 Ternary content-addressable memory XX00X XXXX 11X00X X0X XXXX 10XX010100X0XX X XXXXXXXXXXXXXXXXXXXXXXX XX010X01X X0XXXXX TCAM Associative memory: parallel comparisons against all entries Fixed-width entries Ternary digits: 0 / 1 / X (don ’ t care) Only first match is returned Width of W digits Search key

6 TCAM: pros, cons, usage Pros High throughput Deterministic throughput Cons Higher cost (~X30 than SRAM) Higher power consumption XX00X XXXX 11X00X X0X XXXX 10XX010100X0XX X XXXXXXXXXXXXXXXXXXXXXXX XX010X01X X0XXXXX TCAM Usage Over 6M deployed devices (2004) Used in multi-gigabit systems with >10K rules May support 128K entries of 144- bit, 133M searches/second.

7 The problem: TCAM range representation Match-type rule field value matching key-field exact prefix range ***************** > How can we efficiently represent range rules by TCAM entries?

8 Basic approach: prefix expansion Representing [1,6] TCAM entries: 001, 01*, 10*, 110 Prefix expansion is inefficient A range over W-bits may expand to 2W-2 entries For 2 range-fields, may expand to (2W-2) 2 Expansion factor of up to 6 on real-world databases !!! [1,6]

9 Prior art: use of extra bits XX00X XXXX 11X00X X0X XXXX 10XX010100X0XX X XXXXXXXXXXXXXXXXXXXXXXX XX010X01X X0XXXXX TCAM XXXXX Extra bits (typically 36) Hierarchical database dependent encoding [Liu2002], [Lunteren and Engbersen2003] Database-Independent Range Pre-Encoding [Venkatachary,Lakshminarayanan, Rangarajan2005]

10 Prior art: database-dependent encoding Key idea: allocate an extra bit to commonly occurring ranges. Example Source-port ≥ XX00X XXXX 11X00X X0X XXXX 10XX010100X0XX X XXXXXXXXXXXXXXXXXXXXXXX XX010X01X X0XXXXX TCAM XXXXX Representing a rule Set the assigned extra bit to 1 Set all other extra bits to X XXXXXXXXXXXXXXXXXX 1 Generating the search key If source-port within range set extra bit to 1 Otherwise set extra bit to 0

11 Prior art: database-independent range – pre-encoding (DIRPE) Key idea: Use extra bits for independent encoding, use general ternary values rather than prefixes. Fence encoding (w-bit words) RangeEncoding = i0 2 w -i-1 1 i ≥ ix 2 w -i-1 1 i < i0 2 w -i x i-1 [i,j]0 2 w -1-j X j-i 1 i Fence encoding Expansion 1 Requires 2 w -1 bits What if we have a smaller number of bits? Number i is encoded by: 0 2 w -1-i 1 i

12 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX W+36 bits Key idea: Divide all (regular plus extra) bits to chunks, encode each by fence encoding Prior art: database-independent range – pre-encoding (cont ’ d) What if a smaller number of bits is available? Chunk1 (k 1 bits) Chunk2 (k 2 bits) Chunk3 (k 3 bits) Chunk4 (k 4 bits) Range expansion increases with the number of chunks

13 An Observation: The problem is equivalent to the DNF expression minimization problem R=[10,11] b 1 b 0 + b 1 b ’ 0 ≈ b 1 The general problem is NP-complete. “ Computing the minimum DNF representation of boolean functions defined by interval ” [Schieber, Geist, Zacks, 2005] A linear-time algorithm for finding minimum-size DNF expression for any range of binary-coded numbers Worst-case expansion for binary-encoded numbers is 2W-4 Thanks to Ronny Roth for the observation and the reference to the paper

14 Talk outline Definitions Problem definition, prior art The Short Range Gray Encoding Algorithm Experimental results Open questions

15 Our solution: Short-Range Gray Encoding (SRGE) Hybrid-SRGE yields range-expansion of only 1.02 on real databases Gain without pain : Range expansion reduction can be obtained without the use of extra bits by changing the encoding scheme (SRGE) SRGE can be combined with database-dependent scheme: the Hybrid-SRGE scheme

16 Our solution: observations 1.Ranges tend to be small: typically correspond to similar- functionality ports:  : snmp, snmptrap  67-68: bootps server, bootps client  : Microsoft DirectX 2.Binary coding not optimal for small ranges Binary encoding An example: covering [1,2] Cover set: {01, 10} Gray encoding Cover set: {*1}

bit BRGC: Binary Reflected Gray Code Obviously, not `our ’ Frank Gray Gray code: codewords for consecutive integers differ by single bit 4-bit BRGC: Transforming binary  BRGC is quick

18 Binary Reflected Gray Code (cont ’ d) It is exactly this reflection property that helps decrease expansion

19 The SRGE algorithm Need to find minimum cover of [s,e] using gray coding. se p Find the least common ancestor p of point s and e

20 Let pl be the rightmost leaf in p’s left sub-tree Let pr be the leftmost leaf in p’s right sub-tree se plpr p The SRGE algorithm

21 First, we handle the smaller of: [s,pl], [e,pr] seplpr p The SRGE algorithm

22 prpl Cover by prefixes the smaller range and its mirror relative to p We still need to cover the leftover range [s’,e], if it is non-empty The SRGE algorithm se p s’

23 s' e pl ’ pr ’ Repeat the previous procedure for the leftover: [s',e] find their least common ancestor p’ let pl' be the rightmost leaf in the left sub-tree of p' let pr' be the leftmost leaf in the right sub-tree of p' p’ p pr s The SRGE algorithm

24 Two cases to consider: 1)|[pr', e]| > |[s', pl']|:  Cover [pr', e] by prefixes  The mirror of [pr', e] ( relative to p') covers [s', pl'] pr s’ pl’ pr’ e p’ p s The SRGE algorithm

25 pr s’ pl’ pr’ e 2)|[s', pl']|>|[pr', e']|:  Cover [pr', e] by prefixes.  Cover [s', pl'] by one a single prefix, corresponding to p' left sub-tree p’ p s ql q The SRGE algorithm

26 Hybrid-SRGE For each unique range, compute total number of redundant entries under SRGE Deal with the most expensive ranges by using standard database-dependent encoding

27 Talk outline Definitions Problem definition, prior art The Short Range Gray Encoding Algorithm Experimental results Future work

28 SRGE range-expansion reduction Random ranges

29 Results on a real-life database 223K rules with 300 unique ranges Combined from collection of 126 separate databases (firewall, acl-routers, intrusion prevention systems) Hybrid SRGE Acknowledgment: Cisco, David Taylor (WHSTL) Algorithm Expansion Redundancy Hybrid DIRPE1.12NA Prefix expansion2.6NA

30 Range-length distribution Almost 60% of the unique ranges have length less then 20 Approx. 40% of the total number of ranges have length less then 20

31 A small number of ranges cause most expansion

32 Range expansion bounds The worst-case expansion ratio of SRGE on w-bit words is 2w-4 The worst-case expansion ratio of any range-covering scheme on w-bit words is at least w, regardless of the encoding scheme

33 Expansion as function of bits number 2w-2 2^w-1 w 1 Number of bits used Number of TCAM entries At least W entries required – regardless of the encoding technique SRGE worst-case expansion is 2W-4 entries Unknown