Design of a Multi-Dimensional Packet Classifier for Network Processors

Nowadays packet classification is a fundamental task for network devices such as edge routers, firewalls and intrusion detection systems. Determining which flow packets belong to is important for many applications, and it is necessary, for example, to provide differentiated services, to detect anomalous traffic and to sort attack patterns. Therefore packet classification is becoming more and more complex, with more flexibility and higher performance requirements. Network Processors (NPs) are emerging as very promising platforms due to their capability to combine the flexibility of general-purpose processors with high performance of hardware-based solutions. In this paper we illustrate the design of a multidimensional packet classifier realized on the Radisys® ENP-2611 board equipped with Intel® IXP2400 Network Processor. The first goal of this study is the selection of the most suitable classification algorithm to be integrated into the embedded system. Our investigation is then directed to adjustments and refinements of the selected algorithm (namely the multidimensional multibit trie algorithm) to capitalize the peculiar functional properties and capabilities of our network processor.