Range Matching without TCAM Entries Expansion for Packet Classification

Packet classification has been widely used in network security protection. A number of the major techniques for network security protection, such as virtual private networks (VPN), firewalls, and network intrusion detection systems (NIDS), are all dependent on the speed and ability of packet classification. The complexity of multi-dimensional packet classification will result in large scale rule-sets, which makes it prohibitive for software implementation. Algorithms based on ternary content addressable memory (TCAM) can solve this problem but cause entries expansion during the range matching. Our paper introduces a new region encoding mechanism of range mapping which can eliminate the expansion. By adding a new regional code, which is used to encode the ranges spanning two regions or more, the improved mechanism is able to express all the ranges by only one entry. Simulation and characteristics analysis of real rule-sets verify this encoding mechanism´s feasibility and efficiency in actual applications.