<-- Back to Main Page

Date : Monday, February 13, 2006
Speaker : Fang Yu
Affiliation : UC Berkeley
Talk Title : Gigabit Rate Deep Packet Inspection with Hardware Support
Slides :

Abstract

In today's edge networks, many new services are emerging such as intrusion detection, high speed firewalls, NAT, HTTP load balancing, XML processing, TCP offloading, encryption/decryption, etc. Traditional packet handling techniques, such as next hop forwarding can't support these new services. Instead, we need deep packet inspection techniques that can function on the entire packet contents rather than just the header. I propose deep packet inspection schemes using emerging hardware technologies. First, I propose a multi-match classification solution which intelligently process packet header information using a special memory -- Ternary Content Addressable Memories (TCAMs) due to their ability to perform fast parallel matching. Second, I develop scheme to identify within packet payload also using TCAM. Lastly, I implement an efficient regular expression rewriting scheme and a fast searching engine for multi-core processor environments. With all these techniques, we can perform multi-match packet classification based on multiple fields in the packet header and perform gigabit rate packet payload scanning against thousands of complex patterns. The proposed schemes can efficiently handle long patterns, correlated patterns, patterns with negation, and also general regular expressions.