Randomized Packet Filtering through Specialized Partitioning of Rulesets

A key issue in high speed traffic processing is to immediately detect potentially interesting packets. At very high speed, this operation is particularly crucial as filtering packets close to the wire relieves real applications from handling large volumes of (uninteresting) data. This paper proposes a fast and randomized approach to packet filtering based on partitioning rule databases for their storage in fast and compact Bloom filters that can be placed in fast cache memory. Database partitioning is obtained by a specially tailored clustering algorithm and the results show that even large rulesets can be divided into a limited number of partitions and accommodated in reasonably small Bloom filters.