SplitTrie: A Fast Update Packet Classification Algorithm with Trie Splitting

Abstract

Software Defined Network (SDN) currently is widely used in the implementation of new network technologies owing to its distinctive advantages. In changeable SDN environments, the update performance of SDN switches has significant importance for the overall network performance because packet processing could be interrupted by ruleset updating in SDN switches. In order to guarantee high update performance, we propose a new classification algorithm, SplitTrie, based on trie structures and trie splitting. SplitTrie splits rulesets according to the field type vectors of rules. The splitting can improve the update performance because it reduces the trie structure sizes. Experimental results demonstrated that SplitTrie could achieve 20 times of update speed in the complex rulesets comparing the method without trie splitting.

1. Introduction

Compared with traditional network technology, Software Defined Network (SDN) separates the control plane and the data plane, which has considerable advantages, such as centralized control logic, network virtualization, and open network capabilities [1]. These advantages bring great convenience to many emerging network technologies, typically including Information Centric Networking (ICN) and Network Functions Virtualization (NFV) [2]. Therefore, SDN is widely used in the implementation of new network technologies.

In SDN implementation, the design of SDN switches is one of the most important components. The requirements faced by SDN switches are quite different from those of traditional switches. In the popular SDN implementation, OpenFlow [3], the network environment changes more frequently, and the control message processing affects forwarding performance greatly in OpenFlow switches [4]. Thus, the overall performance of SDN switches depends not only on lookup performance but also on update efficiency. Therefore, we should consider control message processing when we implement SDN switches. The packet processing problem in SDN switches is called packet classification problems. Specifically, the update time-sensitive problems are called online packet classification problems. Otherwise, the rest are regarded as offline packet classification problems.

In OpenFlow, the match rules could be divided into several types according to their contents, such as exact matching, ternary matching and longest prefix matching (LPM) [5]. Exact matching is quite simple, and hash-based algorithms are used to implement exact matching. Many OpenFlow implementations use linear table and some simple algorithms to implement ternary matching and LPM, such as Tuple Space Search (TSS) [6]. The lookup performances of the algorithms are poor, so large quantities of algorithms have been proposed to solve packet classification problems in recent decades [7,8,9,10,11,12,13,14,15,16,17,18]. However, the match rules will be more flexible in some SDN implementations. Match fields of the rules are not limited to the 5-tuples (src_IP, dst_IP, src_port, dst_port, and protocol) in traditional networks. Most of the algorithms only applied in 5-tuples, which will be their shortcomings in the SDN environment nowadays. Among the algorithms, trie-based ones are protocol oblivious and their performance will not deteriorate when the number of rules changes. If there are many additional match fields in SDN work scenes, trie-based algorithms should be a better choice. However, the updating performance of trie-based algorithms is a shortage in online packet classification problems. After analyzing the update process, we put forward a new optimization for the trie-based algorithms applied in online environments.

Our method is to optimize the update processes of online trie-based algorithms. We chose an online trie-based algorithm, ITOC [19] as the algorithm to improve, and designed an optimization for the algorithm. Finally, we proposed a packet classification algorithm, SplitTrie, for the SDN switches in the work scenes, where the match fields of rules are flexible and the rules are changing. The contributions of this paper are:

• Field Type Vector: Based on the idea of field type, we introduced the parameter of rules called field type vector. Field types are also called Big Field and Small Field. The field type shows the match range size of the rule in a match field. Each bit in the field type vector represents the type of one field. Thus, we can know the match range sizes in all match fields by the field type vector.
• Building Optimization: By analyzing the building and update processes, we found the relevance between the match range sizes of the rules and the size of the lookup structures. With field type vector, we designed an optimization for online trie-based packet classification algorithm by splitting the rulesets before building the tries.
• SplitTrie: With the idea of splitting, we designed a new building process and a new update process for the online trie-based algorithm. We call the new online algorithm SplitTrie, which could provide better update performance.

The rest of this paper is organized as follows. In Section 2, we provide a review of the previous and related work. In Section 3, we present our optimization method in detail. Section 4 shows the experimental results and gives out the analysis. Finally, we conclude our work in Section 5.

2. Related Work

2.1. Pre-Process Optimizations of Packet Classification Algorithm

Pre-processing is a popular way to improve the packet classification algorithm. In some packet classification algorithms, pre-processing is necessary. For instance, the results of pre-processing will determine their performance in the decision tree algorithms. A typical kind of pre-processing used in packet classification algorithms is dividing, which includes ruleset splitting and search space cutting. The ruleset will split into subsets, and the search space will be cut into subspaces. How to divide the ruleset is the key to these pre-processing methods.

Methods of dividing rules proposed during the last decades can be summarized into the following categories:

• Dividing by match value, such as ruleset splitting and search space cutting in tree-based algorithms [7,8,9,11,13,18];
• Dividing by mask value, such as TSS, TupleMerge [14], CutTSS [17], and CNP3 [16];
• Dividing by other parameters, such as dimensions [10].

Different methods have their advantages and disadvantages. For the ruleset splitting methods, the main shortcoming is that the pre-processing time is too long. Some methods split the ruleset into several subsets which contain the same number of rules, and these methods will suffer from ruleset changing. Some splitting-based algorithms proposed to shorten the pre-processing time. In the search space cutting methods, the main shortcoming is the rule replication, which results in the waste of memory. The main target of the algorithms is to avoid replication. Although having a good update performance, Tuple Space Search has a poor lookup performance due to the number of tuples in some cases. All the TSS-based algorithms are aimed to limit the number of tuples.

2.2. What We Need in Target Work Scenes

As we mentioned in the introduction Section, our motivation is to design a packet classification algorithm for a special kind of SDN environment. In the environment, the definitions of rule match fields are more flexible. Furthermore, rules in switches will change continuously. The problems are called protocol-oblivious problems and online problems.

In online packet classification problems, many pre-processing methods become ineffective when the working condition changes. In online problems, we could not obtain all the contents of flow tables in the pre-processing stage. We prefer to choose one implementation that can be applied with limited information. The implementation should have these features:

• The divide functions can work with limited ruleset information;
• The divide functions should be simple enough;
• The divide functions should have little influence on lookup performance.

TSS is a method that does not need the information of all the rules. TSS divides the rulesets according to the exact match length. Thus, the dividing pre-processing of TSS only needs the content of the individual rule. As mentioned above, the lookup performance of TSS is poor because the number of subsets could be too big. An optimization for TSS is given by TupleMerge [14]. TupleMerge can reduce the number of tuples by merging similar but not identical tuples. Another idea is used in EffiCuts [9], HybridCuts [11], CutSplit [13] and CutTSS [17]. The idea introduces two definitions, Big Field and Small Field. The methods divide the rules according to the match range sizes in some fields. The idea has been combined with decision tree and TSS, we will use the idea in our optimization for the trie-based algorithms.

3. The Proposed Algorithm

3.1. Definition of Big Field, Small Field, and Field Type Vector

Our algorithm provides a pre-processing optimization for the trie structures based on the match range sizes. We explain what are the match range sizes based on an N-dimensional rule $\mathbf{R}$ = ($F_1$, … $F_i$, … $F_N$) with a threshold set T = ($T_1$, … $T_i$, … $T_N$) for each field, where i ∈ {1, 2, … N}. We define the big field and the small field as follows:

• ${\mathbf{F}}_{\mathbf{i}}$ in rule $\mathbf{R}$ is a big field when the match range length of $F_i$/field range length $L_i$ > threshold value $T_i$.
• ${\mathbf{F}}_{\mathbf{i}}$ in rule $\mathbf{R}$ is a small field when the match range length of $F_i$/field range length $L_i$ ≤ threshold value $T_i$.

Based on Big field and Small field, we define a type of rules called big rule.

• $\mathbf{R}$ is a big rule when all fields in $\mathbf{R}$ are big fields.

Moreover, to describe other types of rules, we define a vector called field type vector. The definition of the vector is:

• $V_{fs}$ is a N bits long vector, where N is the number of fields of the rule; the i-th bit of $V_{fs}$ is 1 if $F_i$ is a big field; the i-th bit of $V_{fs}$ is 0 if $F_i$ is a small field.

As shown in the definition, field type vectors are rough descriptions of match range sizes of rules in each field. In our algorithm, rules in the flow tables will be divided according to their field type vectors.

3.2. Why the Optimization Benefits in Trie Methods

Before proposing our optimization, we explain how the trie-based packet classification algorithms can benefit from the ruleset splitting according to the match range sizes.

In trie-based algorithms, the complexity of rulesets has an impact on the performance of algorithms. The number of rule overlaps is a typical instance. Generally, when overlapping occurs in two rules in a ruleset, some extra nodes will be generated in the trie of the ruleset. Thus, the number of rule overlaps matters in the trie-based algorithms.

We can infer that the overlaps will be less with the ruleset splitting according to the field type vectors. After analyzing the relationship of rule overlaps and field type vectors, we can classify the overlaps into three types: Two-small, One-big, and Complementary.

We define Two-small overlap as following: an overlap between Rule A and B is a Two-small overlap when neither A nor B are big rules and $V_{fsA}$, $V_{fsB}$ have only few $\mathbf{1}$ bits.

An example of Two-small overlaps is shown in Figure 1. Each bar stands for a field, and the colored zone stands for the match range of a rule. As shown in Figure 1, Rule 0 and Rule 1 are not big rules. Their match ranges overlap in every field even though they only have small fields in the fields. It could happen because the distribution of rules in a ruleset is usually uneven.

An overlap between Rule A and B is a One-big overlap when A or B is a big rule.

An example of One-big overlaps is shown in Figure 2. In the example, Rule 1 is a big rule. Generally, a big rule has a large match range. Thus, the rule is more likely to overlap with other rules. When we find an One-big overlap, we could find more One-big overlaps. As the distribution of rule matching ranges is uneven, there could be more other rules covered by the match range of the big rule in some cases.

The last is Complementary overlap. An overlap between Rule A and B is a Complementary overlap when $V_{fsA}\cup V_{fsB}$ = $(1111\dots 11)$.

Complementary means the big fields of the two rules include all fields of the ruleset, as shown in Figure 3. The field type vector of Rule 0 is $\left(01010\right)$ and the field type vector of Rule 1 is $\left(10101\right)$. As a big field is easier to overlap with others at the field, when two rules have at least one big field at each field, the two rules could overlap with a high probability.

Consequently, by dividing the rules according to their field type vectors, we can prevent most of One-big overlaps, and all Complementary overlaps. As most of One-big overlaps are between Big rules and other rules, and all Complementary overlaps are between the rules with different field type vectors.

We analyzed some rulesets which are given by the widely used test bench project, ClassBench [20,21]. We found that most overlaps in the rulesets are One-big overlaps and Complementary overlaps. The analysis is as follows.

Firstly, we calculated the field type vectors of the rules in 3 rulesets. The rulesets are different types, and each ruleset contains 10,000 rules. All rules have 5 fields, SRC IP, DST IP, SRC port, DST port, and protocol. For simplicity, we used only SRC IP and DST IP fields to calculate the field type vectors. When we set the threshold as 80%, the distribution of the field type vectors in the rulesets are as shown in Figure 4.

In ACL rulesets, over 96% rules are with the field type vector (small, small). FW rulesets are the most complex rulesets. Around 90% rules have at least one big field. In the IPC rulesets, 20% rules have at least one big field, which means IPC rulesets are also complex ones.

Then we counted and classified the overlaps. The results are shown in

Table 1. Average overlap number of different types of rules.

	Two-Small		One-Big		Complementary
	Number	Proportion	Number	Proportion	Number	Proportion
ACL	4888	10.46%	40,041	85.71%	1789	3.83%
FW	1	0.00%	336,939	11.62%	2,562,472	88.38%
IPC	10,494	2.22%	125,506	26.59%	336,046	71.19%

, and the major types of overlaps in each ruleset are marked in red. In the ACL ruleset, most overlaps are One-big overlaps. In the FW ruleset and the IPC ruleset, most overlaps are Complementary overlaps. As mentioned above, our optimization could prevent most of One-big overlaps and all Complementary overlaps. Thus, we make the conclusion that the trie-based algorithms will benefit from the ruleset splitting according to the field types of rules.

3.3. Optimization Using Big Field and Small Field

Our optimization splits rulesets according to the field type vectors of rules and then builds tries for each subset. If all fields are taken into consideration in the rule partition, the trie number will be huge. The huge trie number has a negative impact on the lookup performance. Therefore, in practice, we generally choose several typical fields to calculate the field type vectors.

Now, we apply the optimization on ITOC and put forward our new algorithm, SplitTrie. Our pre-processing optimization will influence both the building processing and the update processing.

In the building process, we first decide the used field number N for calculating field type vectors. We set the number according to the ruleset size. Then we choose the fields according to their length because generally, longer fields are more distinguished and have a greater impact on the tries. After choosing the fields, we build $2^N$ tries for the ruleset. Each trie will have a field type vector. For example, if we build a 5-tuple table that contains 10,000 rules, we could choose two fields to calculate field type vectors, and the chosen fields will be SRC IP and DST IP. As the used field number is 2, we will build four tries, and their field type vectors are 00, 01, 10, and 11.

As the deletion process is simple in trie-based algorithms, we mainly focus on the insertion process. When a new rule is added to the table, we will calculate its field type vector at first. At the same time, we also transform the rule into a single trie. With the field type vector, we could merge the single trie into a proper trie. After the trie merging, the algorithm will generate a new lookup array and finish the update processing, as shown in Figure 5.

The update processing without pre-processing optimization is shown in Figure 6a, and the update processing with our pre-processing optimization is shown in Figure 6b. The main differences are marked in red.

The pseudocodes of the new building process and insertion update process are shown in Algorithms 1 and 2.

In SplitTrie, the time cost of the building process and the update process will be less than that in the original algorithm, which will be shown in the experiments.

Algorithm 1: Building process with ruleset splitting

Input: the maximum size M of ruleset $\mathbb{S}$, fields {$F_1$, $F_2$, $F_3$ … $F_n$}  Output: ruleset $\mathbb{S}$ 1  Calculate the number of chosen fields N according to the maximum size M; 2  Choose the top N longest fields among {$F_1$, $F_2$, $F_3$ … $F_n$}; 3  Generate $2^N$ different field type vectors {$V_1$, $V_2$, $V_3$ … $V_n$} 4  for $V_i$ in the field type vectors do 5  ∣ Build a trie $T_i$ with field type vector $V_i$; 6  end

Algorithm 2: Insertion process with ruleset splitting

4. Experimental Results

4.1. Simulation Setup

In order to show the improvement of our optimization, we first design a simulation. The experimental simulation runs on a Linux platform with Intel Xeon Silver 4208 CPU @ 2.10 GHz. The operating system is CentOS release 7 September 2009. The implementation is based on DPDK.

The experiments are designed to evaluate the lookup performance and the updating performance of the algorithms. The rulesets we used in the experiments are generated by the widely used test bench project ClassBench. With the rulesets, we compared the performance of the algorithms with and without ruleset splitting. In the experiments, the threshold between big fields and small fields is 80% in all fields.

4.2. Results and Analysis

Our experiments consist of two parts. In the first part, we compared the performance of SplitTrie with the original trie-based algorithm to show the effectiveness of the pre-processing optimization. The second part is the comparisons between SplitTrie and other state-of-the-art solutions.

In the first part, we compared the memory footprints, the lookup performance, and the update performance of SplitTrie and ITOC. SplitTrie is with our splitting optimization, while ITOC is without splitting. We built rule tables and added all rules of the rulesets into the tables. Then we counted the numbers of nodes and tries of each table to compare memory footprint. The comparison is shown in Figure 7.

With our optimization, the numbers of tries in FW rulesets and IPC rulesets are smaller. However, the situation becomes the opposite in ACL rulesets. The reason is that the rules in ACL are too simple. Most rules in ACL rulesets are the type of (Small, Small) as shown in Figure 2. Without our optimization, the number of tries is not big at all in ACL rulesets. However, SplitTrie will build at least 4 tries. Although our optimization could reduce overlaps and the total node numbers, the number of tries built by SplitTrie is still bigger in the ACL rulesets, which would be the main limitation of our optimization. In the simple rulesets, the number of tries our algorithm will build is too big, so the performance will be poor. Since SplitTrie is not suitable enough for ACL rulesets, we will focus on FW rulesets and IPC rulesets in subsequent experiments.

Then we calculated the lookup time cost and update latency. We generated data entries so that all rules could be hit in the lookup experiment and input them into the lookup interface. We calculated the average time cost of the interface. Figure 8 shows the results of the lookup time cost comparison.

The results show the advantages of our optimization. As shown in Figure 8, SplitTrie had a better lookup speed in FW rulesets and IPC rulesets. In the best case, the lookup speed of SplitTrie is 2.75 times that of the algorithm without the optimization. Although SplitTrie is not aimed to provide a better lookup speed, this performance also shows that SplitTrie performs better in the complex rulesets because the splitting avoids the rule range overlaps.

Then we designed the update experiment. We first picked out 100 rules from the rulesets and added the rest into the tables. The rest rules were called base rules. Then we added the picked out rules into the tables, which contained base rules. We calculate the average latency of these update processes. Figure 9 shows the results of the update latency comparison.

The update performance comparison of SplitTrie also proves this conclusion. As shown in Figure 7, the number of nodes in tries are much smaller in SplitTrie, and the fewer nodes can make SplitTrie update faster in the complex rulesets. As shown in Figure 9, the optimization resulted in a shorter update latency. In the best case, the update latency of SplitTrie is only 5% of the time of the original algorithm. In other words, SplitTrie could achieve 20 times of update speed of the original algorithm when we have a complex ruleset.

In the second part, we compared the performance of SplitTrie with state-of-the-art solutions. We tested the lookup performances of SplitTrie, DPDK ACL, TupleMerge, PartitionSort, and CutTSS. DPDK ACL [22] is an offline trie-based packet classification algorithm provided by the popular packet processing platform, DPDK. TupleMerge PartitionSort, and CutTSS are state-of-the-art online solutions. TupleMerge, as mentioned before, is an optimized algorithm based on TSS. PartitionSort is a special algorithm in which we divide the ruleset into some sortable parts and then build a tree according to the partition. Furthermore, CutTSS is the algorithm which combined Big field and Small field idea with TSS algorithms. Figure 10 shows the results of the lookup time cost comparison.

The results show that SplitTrie reaches the level of the state-of-the-art solutions in lookup speed. Our optimization for update latency has no negative impact on lookup performance in the complex rulesets. Considering the parallel processing ability of SplitTrie, the applicability for any type of field and the quick update speed, SplitTrie can be a better choice in some specific work scenes, such as the changeable SDN environments.

5. Conclusions

The work of this paper is about packet classification problems in SDN environments. We provided an optimized algorithm, which is called SplitTrie. It is applied in the pre-processing stage of trie-based packet classification algorithms. The optimization is based on the idea of Big Field and Small Field. With the optimization, SplitTrie divides the rules by their field type vectors and inserts similar rules into the same tries. SplitTrie tries to avoid the overlaps of rule match ranges in the rulesets and is helpful to simplify the insertion progress. The experimental results show that, with the optimization, SplitTrie reduced the number of nodes and tries in the packet classification algorithms. The improvement in memory usage helps SplitTrie achieve better performance than the original algorithm in the complex rulesets. The result reveals that SplitTrie is a better choice in the SDN work scenes where flow table rules are complex and changeable. The main limitation of our algorithm is that the algorithm could not achieve better performance in simple rulesets. We will further work on this algorithm to improve it. As the problem is that SplitTrie splits the rulesets unnecessarily when the rulesets are too simple, our idea is to design a method to detect and merge unnecessary splitting before the lookup structures are generated.