Wire-Speed TCAM-Based Architectures for Multimatch Packet Classification

Abstract—Most conventional packet classifiers find only the highest priority filter that matches the arriving packet. However, new networking applications such as network intrusion detection systems and load balancers require all (or the first few) matching filters during classification. In this paper, two TCAM-based architectures for multimatch search are introduced. The first one is a renovated TCAM design that can find all or the first r matches in a packet filter set. The second architecture is a novel partitioning scheme based on filter intersection properties allowing us to use off-the-shelf TCAMs for multimatch packet classification. Our classifier engine finds all matches in exactly one conventional TCAM cycle while reducing the power consumption by at least two orders of magnitude, which is far better than the existing hardware-based designs. Index Terms—Ternary content addressable memory, multimatch, packet classification, prioritizer, network intrusion detection system, maximum-minimum intersection partitioning, contention resolver.