Modeling filtering predicates composition with Finite State Automata

Designing an efficient and scalable packet filter for modern computer networks becomes each day more challenging: the increased data rate and a much higher number of active hosts make filtering expressions more complex than in the past, noticeably stressing the filtering systems. Some architectures focus on the most used filtering patterns and predicates, but must use a slower fallback if filtering on “less used” ones; dynamic code generation systems implement complex optimizations, but these compiler-oriented algorithms focus only on the final code, where most of the protocol abstraction is lost. This paper presents mpFSA, a novel packet filter model based on the Finite State Automata formalism to guarantee optimality w.r.t. the number of packet accesses, that aims at allowing powerful optimizations without sacrificing efficiency and scalability.