Large-scale wire-speed packet classification on FPGAs
Proceedings of the ACM/SIGDA international symposium on Field programmable gate arrays
Field-split parallel architecture for high performance multi-match packet classification using FPGAs
Proceedings of the twenty-first annual symposium on Parallelism in algorithms and architectures
Acceleration of packet filtering using gpgpu
Proceedings of the 4th international conference on Security of information and networks
Speedy FPGA-based packet classifiers with low on-chip memory requirements
Proceedings of the ACM/SIGDA international symposium on Field Programmable Gate Arrays
International Journal of Reconfigurable Computing
Scalable packet classification on FPGA
IEEE Transactions on Very Large Scale Integration (VLSI) Systems
Hardware accelerators targeting a novel group based packet classification algorithm
International Journal of Reconfigurable Computing
An impulse-c hardware accelerator for packet classification based on fine/coarse grain optimization
International Journal of Reconfigurable Computing
| Hi-index | 0.00 |
High end network security applications demand high speed operation and large rule set support. Packet classification is the core functionality that demands high throughput in such applications. This paper proposes a packet classification architecture to meet such high throughput. We have implemented a Firewall with this architecture in reconfigurable hardware. We propose an extension to Distributed Crossproducting of Field Labels (DCFL) technique to achieve scalable and high performance architecture. The implemented Firewall takes advantage of inherent structure and redundancy of rule set by using our DCFL Extended (DCFLE)algorithm. The use of DCFLE algorithm results in both speed and area improvement when it is implemented in hardware. Although we restrict ourselves to standard 5-tuple matching, the architecture supports additional fields. High throughput classification invariably uses Ternary Content Addressable Memory (TCAM) for prefix matching, though TCAM fares poorly in terms of area and power efficiency. Use of TCAM for port range matching is expensive, as the range to prefix conversion results in large number of prefixes leading to storage inefficiency. Extended TCAM (ETCAM) is fast and the most storage efficient solution for range matching. We present for the first time a reconfigurable hardware implementation of ETCAM. We have implemented our Firewall as an embedded system on Virtex-II Pro FPGA based platform, running Linux with the packet classification in hardware. The Firewall was tested in real time with 1 Gbps Ethernet link and 128 sample rules. The packet classification hardware uses aquarter of logic resources and slightly over one third of memoryresources of XC2VP30 FPGA. It achieves a maximum classification throughput of 50 million packets corresponding to16 Gbps link rate for the worst case packet size. The Firewall rule update involves only memory re-initialization in software without any hardware change.