An argument for simple embedded ACL optimisation

Authors:
Vic Grout;John Davies;John McGinn
Affiliations:
Centre for Applied Internet Research (CAIR), University of Wales, NEWI, Wrexham, LL11 2AW, UK;Centre for Applied Internet Research (CAIR), University of Wales, NEWI, Wrexham, LL11 2AW, UK;Centre for Applied Internet Research (CAIR), University of Wales, NEWI, Wrexham, LL11 2AW, UK
Venue:
Computer Communications
Year:
2007

Citing 3
Cited 0

Network Algorithmics,: An Interdisciplinary Approach to Designing Fast Networked Devices (The Morgan Kaufmann Series in Networking)

Network Algorithmics,: An Interdisciplinary Approach to Designing Fast Networked Devices (The Morgan Kaufmann Series in Networking)
Linux Firewalls (3rd Edition) (Novell Press)

Linux Firewalls (3rd Edition) (Novell Press)
Modeling and Management of Firewall Policies

IEEE Transactions on Network and Service Management

Quantified Score

Hi-index	0.24

Visualization

Abstract

The difficulty of efficiently reordering the rules in an Access Control List is considered and the essential optimisation problem formulated. The complexity of exact and sophisticated heuristics is noted along with their unsuitability for real time implementation embedded in the hardware of the network device. A simple alternative is proposed, in which a very limited rule reordering is considered following the processing of each packet. Simulation results are given from a range of traffic types. The method is shown to achieve savings that make its use worthwhile for lists longer than a given number of rules. This number is dependent on traffic characteristics but generally around 25 for typical network conditions.