Abstract Packet Classification using Hierarchical Intelligent Cuttings

Internet routers that operate as firewalls, or provide a variety of service classes, perform different operations on different flows. A flow is defined to be all the packets sharing common header characteristics; for example a flow may be defined as all the packets between two specific IP addresses. In order to classify a packet, a router consults a table (or classifier) using one or more fields from the packet header to search for the corresponding flow. The classifier is a list of rules that identify each flow and the actions to be performed on each. With the increasing demands on router performance, there is a need for algorithms that can classify packets quickly with minimal storage requirements and allow new flows to be frequently added and deleted. In the worst case, packet classification is hard requiring routers to use heuristics that exploit structure present in the classifiers. This paper presents such a heuristic, called HiCuts, (hierarchical intelligent cuttings), which exploits the structure found in classifiers. We describe HiCuts and examine its performance against real classifiers in use today. When compared with previously described algorithms and used to classify packets based on four header fields, the algorithm is found to classify packets quickly and has relatively small storage requirements.