Abstract: A computer-implemented system is provided for implementing application protocol field extraction. The system includes: an automata generator configured to receive the extraction specification that specifies data elements to be extracted from data packets and generate a counting automaton; and a field extractor configured to receive a data flow and operates to extract data elements from the data packets in accordance with the counting automaton. The extraction specification is expressed in terms of a context-free grammar, where the grammar defines grammatical structures of data packets transmitted in accordance with an application protocol and includes counters used to chronicle parsing history of production rules comprising the grammar.

Abstract: A method is provided for computing network reachability in a computer network. The method includes: identifying each of the subnetworks that comprise a computer network; determining, for each pair of subnetworks, data paths between the two subnetworks; for each identified data path, identifying access control lists implemented along a given data path and formulating a diagram that merges reachability sets derived from the access control lists along the given data path; and, deriving, for each pair of subnetworks, a set of network packets that can traverse between the subnetworks from the formulated diagrams.

Abstract: A method is provided for implementing regular expression matching using ternary content-addressable memory devices. The method includes: receiving a set of regular expressions (REs) that specify data elements to be extracted from data packets; constructing a deterministic finite automaton (DFA) from the set of regular expressions; building a state transition table for each node of the deterministic finite automaton; combining the state transition tables into a single lookup table; and instantiating the lookup table in a ternary content-addressable memory device. Additional techniques are provided to reduce the TCAM space and improve RE matching speed.

Abstract: An improved technique is provided for compressing a packet classifier for a computer network system. A set of packet classification rules is first partitioned into one or more partitions. For each partition, columns of bits in each of the ternary strings of a given partition are reordered, the ternary strings within each partition are consolidated into one or more replacement strings and then the columns of bits of the replacement strings are rearranged back to the starting order. The rearranged replacement strings from each of the partitions are appended together to form a compressed packet classifier which may be instantiated in a content-addressable memory device.

Abstract: A computer-implemented system is provided for implementing application protocol field extraction. The system includes: an automata generator configured to receive the extraction specification that specifies data elements to be extracted from data packets and generate a counting automaton; and a field extractor configured to receive a data flow and operates to extract data elements from the data packets in accordance with the counting automaton. The extraction specification is expressed in terms of a context-free grammar, where the grammar defines grammatical structures of data packets transmitted in accordance with an application protocol and includes counters used to chronicle parsing history of production rules comprising the grammar.

Abstract: An improved technique is provided for compressing a packet classifier for a computer network system. A set of packet classification rules is first partitioned into one or more partitions. For each partition, columns of bits in each of the ternary strings of a given partition are reordered, the ternary strings within each partition are consolidated into one or more replacement strings and then the columns of bits of the replacement strings are rearranged back to the starting order. The rearranged replacement strings from each of the partitions are appended together to form a compressed packet classifier which may be instantiated in a content-addressable memory device.

Abstract: A method is provided for implementing regular expression matching using ternary content-addressable memory devices. The method includes: receiving a set of regular expressions (REs) that specify data elements to be extracted from data packets; constructing a deterministic finite automaton (DFA) from the set of regular expressions; building a state transition table for each node of the deterministic finite automaton; combining the state transition tables into a single lookup table; and instantiating the lookup table in a ternary content-addressable memory device. Additional techniques are provided to reduce the TCAM space and improve RE matching speed.

Abstract: A method is provided for computing network reachability in a computer network. The method includes: identifying each of the subnetworks that comprise a computer network; determining, for each pair of subnetworks, data paths between the two subnetworks; for each identified data path, identifying access control lists implemented along a given data path and formulating a diagram that merges reachability sets derived from the access control lists along the given data path; and, deriving, for each pair of subnetworks, a set of network packets that can traverse between the subnetworks from the formulated diagrams.