Packet classification acceleration using spectral analysis
A method and packet filtering system that accelerates the packet classification problem is made. Using spectral analysis of rules and using real time spectral analysis of packets, it is possible to determine very quickly that a packet does not match any of the possible rules that have been defined. That is to say, using the packet filtering of the invention, there is no possibility of a false negative decision; when a packet is determined not to match any rule, the work of a packet classifier is complete. This method and system are also capable, with a high degree of accuracy, of determining that the packet has matched one of the defined rules, so that the packet may be then directed to a packet classifier to determine the specific rule it matches.
1. A method for filtering packets in a real time stream of incoming packets, comprising:
creating a key from a field in a packet having a header, the field being specified by a set of packet classification rules;
transforming the key into a spectral domain key;
comparing the spectral domain key to a spectral envelope, the spectral envelope comprising both a phase envelope and an amplitude envelope and also corresponding to the set of packet classification rules;
obtaining a negative decision whenever the spectral domain key falls outside at least one of the phase envelope and the amplitude envelope;
obtaining a positive decision whenever the spectral domain key falls within both the phase envelope and the amplitude envelope; and
for said positive decision, directing the packet to a packet filter for determining a specific packet classification rule from the set of packet classification rules that the packet matches.
2. The method of claim 1 , further comprising:
generating the key from a plurality of fields in the header of the packet.
3. The method of claim 1 , further comprising:
generating the spectral envelope offline; and
storing the spectral envelope in an envelope database.
4. The method of claim 1 , further comprising:
generating the spectral envelope by calculating the phase and amplitude for each rule in the set of packet classification rules; and
determining the minimum and maximum values at each frequency over all rules of the set of packet classification rules.
5. The method of claim 4 , further comprising:
for a rule using ranges, decomposing the rule into individual explicit rules.
6. A packet filtering system for classifying packets in a real time stream of incoming packets, comprising:
a key generator that creates a key from one or more fields of a packet, the fields being specified by a set of packet classification rules;
a Fast Fourier Transform unit that transforms the key into a spectral domain key; and
an envelope comparator that compares the spectral domain key to a spectral envelope, the spectral envelope comprising both a phase envelope and an amplitude envelope and also corresponding to the set of packet classification rules, and obtains a negative decision whenever the spectral domain key falls outside at least one of the phase envelope and the amplitude envelope, and a positive decision whenever the spectral domain key falls within both the phase envelope and the amplitude envelope.
7. The packet filtering system of claim 6 , further comprising:
a packet filter that receives from the envelope comparator only the packets with a positive decision and determining the specific rule of the set of packet classification rules that the packet matches.
8. The packet filtering system of claim 6 , further comprising:
an envelope generator that generates an amplitude and a phase envelope for the set of packet classification rules, by determining the minimum and maximum values at each frequency component over all rules of the set of packet classification rules; and
an envelope database that stores the amplitude and phase envelopes for the set of packet classification rules and any additional set of rules used at a router.