Lightweight Traffic-Aware Packet Classification for Continuous Operation Author: Shariful Hasan Shaikot, Min Sik Kim Presenter: Yen-Chun Tseng Date: 2014/11/26 Department of Computer Science and Information Engineering National Cheng Kung University, Taiwan R.O.C.

Outline Introduction Related Work Proposed scheme Performance Evaluation Conclusion Computer & Internet Architecture Lab CSIE, National Cheng Kung University 2

Introduction (1/2) Most of the current packet classification techniques do not consider the pattern of the incoming traffic and exploit the characteristics of the rule-set, but this paper not. Lightweight traffic-aware packet classifier reorganizes its internal data structure (rule tree) based on the traffic pattern to reduce the search time for the most frequently visited rules in the rule-set. (online) Computer & Internet Architecture Lab CSIE, National Cheng Kung University 3

Introduction (2/2) npf is a decision tree based algorithm. It uses a special data structure called “Interval based Rule Tree (IRT)” The dynamic adaptation to the traffic pattern in npf is done by using a technique called “tree rotation”. Computer & Internet Architecture Lab CSIE, National Cheng Kung University 4

Outline Introduction Related Work Proposed scheme Performance Evaluation Conclusion Computer & Internet Architecture Lab CSIE, National Cheng Kung University 5

Related Work (1/3 - npf) Computer & Internet Architecture Lab CSIE, National Cheng Kung University 6 The main difference between npf and the existing packet classifier lies on npf’s online dynamic adaptation of data structure to traffic dynamics in order to achieve superioraverage case performance.

Related Work (2/3 - IRT) everything (IP address port number) is considered in terms of interval or range. IRT is based on the binary-search-tree property. Let x be a node. If y is a node in the left subtree of x, then end range[y] < begin range[x]. Each node x has the following properties: an interval [begin range, end range], popularity and {list of ruleID} Computer & Internet Architecture Lab CSIE, National Cheng Kung University 7

Related Work (2/3 - IRT) Computer & Internet Architecture Lab CSIE, National Cheng Kung University 8

Motivation In order to promote the higher popular nodes towards the root of tree and demotes the less popular nodes towards the leaf of the tree. The main objective of our approach was exploiting traffic pattern to minimize the maximum number of operations (memory accesses) Computer & Internet Architecture Lab CSIE, National Cheng Kung University 9

Outline Introduction Related Work Proposed scheme Performance Evaluation Conclusion Computer & Internet Architecture Lab CSIE, National Cheng Kung University 10

Proposed Scheme (1/13) The max-heap property mandates that for any non-root node the popularity must be less than to the popularity of its parent. Computer & Internet Architecture Lab CSIE, National Cheng Kung University 11

Proposed Scheme(2/13) Use the tree rotation technique to regain the max-heap property. Left rotation : makes y the new root of the subtree, with x as y’s left child and y’s left child as x’s right child. Right rotation : makes y the new root of the subtree, with x as y’s right child and y’s right child as x’s left child Computer & Internet Architecture Lab CSIE, National Cheng Kung University 12

Proposed Scheme(3/13) Left rotation : left rotation on a node x, we assume that its right child y is not NULL Computer & Internet Architecture Lab CSIE, National Cheng Kung University 13 X Y

Proposed Scheme(4/13) makes y the new root of the subtree, with x as y’s left child and y’s left child as x’s right child. Computer & Internet Architecture Lab CSIE, National Cheng Kung University 14 Y X

Proposed Scheme(5/13) Right rotation : right rotation on a node x we assume that its left child y is not NULL. Computer & Internet Architecture Lab CSIE, National Cheng Kung University 15 X Y

Proposed Scheme(6/13) makes y the new root of the subtree, with x as y’sright child and y’s right child as x’s left child Computer & Internet Architecture Lab CSIE, National Cheng Kung University 16 Y X

Proposed Scheme(7/13) search Computer & Internet Architecture Lab CSIE, National Cheng Kung University 17

Proposed Scheme(8/13) The match rule = {SIP} ∩{DIP}∩ {SP} ∩ {DP} ∩ {PROTO} Computer & Internet Architecture Lab CSIE, National Cheng Kung University 18

Proposed Scheme(9/13) Computer & Internet Architecture Lab CSIE, National Cheng Kung University 19 Suppose an IP packet source with source port 600 is sent to the destination port 80 of protocol = 6 {SIP} = {1, 2}

Proposed Scheme(10/13) Computer & Internet Architecture Lab CSIE, National Cheng Kung University 20 Suppose an IP packet source with source port 600 is sent to the destination port 80 of protocol = 6 {DIP} = {1, 2} {SIP}∩{DIP} ={1,2}

Proposed Scheme(11/13) Computer & Internet Architecture Lab CSIE, National Cheng Kung University 21 Suppose an IP packet source with source port 600 is sent to the destination port 80 of protocal is 6 {SP} = {1} {SIP}∩{DIP}∩{SP}={1}

Proposed Scheme(12/13) Computer & Internet Architecture Lab CSIE, National Cheng Kung University 22 Suppose an IP packet source with source port 600 is sent to the destination port 80 of protocol = 6 {DP} = {1} {SIP}∩{DIP}∩{SP} ∩{DP}={1}

Proposed Scheme(13/13) Computer & Internet Architecture Lab CSIE, National Cheng Kung University 23 Suppose an IP packet source with source port 600 is sent to the destination port 80 of protocol = 6 {Proto} = {1} {SIP}∩{DIP}∩{SP}∩{DP}∩{Proto}={1}

Outline Introduction Related Work Proposed scheme Performance Evaluation Conclusion Computer & Internet Architecture Lab CSIE, National Cheng Kung University 24

Performance Evaluation (1/3) Computer & Internet Architecture Lab CSIE, National Cheng Kung University 25

Performance Evaluation (2/3) Computer & Internet Architecture Lab CSIE, National Cheng Kung University 26

Performance Evaluation(3/3) Computer & Internet Architecture Lab CSIE, National Cheng Kung University 27