Abstract: An improvement in the compilation of classification tables from across control lists increases the efficiency of memory utilization by fragments in the lower level tables and using the classification ID's from a pair of higher-level tables as pointers to the fragments and as indicators of the depth of the entries in the fragments. A further improvement makes use of aggregate bit vectors, thereby simplifying construction of the lower-level tables. The bit-vector sections preferably coincide with the cache lines of the processing, thereby maximizing the speed with which the relevant bits in the bit vector can be identified from the aggregate bit vectors.

Abstract: A method and apparatus for classification of packets is provided. The method includes classifying the packets based on the structured part of at least one packet classification rule, and classifying the packets based on the unstructured part of the at least one packet classification rule, the classification being done based on the structured classification results. The packet classification method provides a technique for splitting the n-dimensional space of the packet header fields into disjoint regions. The splitting is done such that all the packets falling into a region have the same packet classification result. The first packet falling into a region takes a longer time for classification, where the logical expression resulting from user-configured rule is solved. The classification of all subsequent packets falling into the same region gets accelerated and takes less time than the first packet to classify.

Abstract: A technique classifies packets in a manner that enables the number of lookup operations performed when classifying a data packet to be reduced. A lookup operation is performed to identify a set of rules and a set of actions associated with the data packet. If the action is the same for all the rules represented in the set of rules, the data packet is classified in accordance with the action and further lookup operations are not performed. Otherwise, a next-level lookup operation is performed and the process is repeated. This process continues for successive levels until either a level is reached where the packet is classified or a final level is reached. If a final level is reached, an action is performed based on the results of the lookup operation at the final level.