US 20100098081 A1 Abstract Methods and systems for performing parallel membership queries to Bloom filters for Longest Prefix Matching, where address prefix memberships are determined in sets of prefixes sorted by prefix length. Hash tables corresponding to each prefix length are probed from the longest to the shortest match in the vector, terminating when a match is found or all of the lengths are searched. The performance, as determined by the number of dependent memory accesses per lookup, is held constant for longer address lengths or additional unique address prefix lengths in the forwarding table given that memory resources scale linearly with the number of prefixes in the forwarding table. For less than 2 Mb of embedded RAM and a commodity SRAM, the present technique achieves average performance of one hash probe per lookup and a worst case of two hash probes and one array access per lookup.
Claims(36) 1. A method for performing a network address lookup, said method comprising the steps of:
grouping forwarding prefixes from a routing table by prefix length; associating each of a plurality of Bloom filters with a unique prefix length; programming each of said plurality of Bloom filters with said prefixes corresponding to said associated unique prefix length; and performing membership probes to said Bloom filters by using predetermined prefixes of a network address. 2. The method according to storing said prefixes in a hash table. 3. The method according to 4. The method according to 5. The method according to 6. The method according to 7. The method according to 8. The method according to 9. The method according to 10. The method according to 11. The method according to providing asymmetric Bloom filters by proportionally allocating an amount of an embedded memory per Bloom filter based on said Bloom filter's current share of a total number of prefixes while adjusting a number of hash functions of said Bloom filters to maintain a minimal false positive probability. 12. The method according to 13. The method according to 14. The method according to utilizing a direct lookup array for initial prefix lengths and asymmetric Bloom filters for the rest of the prefix lengths. 15. The method according to 16. The method according to uniformly distributing prefixes of a predetermined length across a set of mini-Bloom filters; and storing each of said prefixes in only one of said mini-Bloom filters. 17. The method according to calculating a primary hash value over said one of said prefixes. 18. The method according to storing said one of said prefixes in said one of said mini-Bloom filters pointed to by said primary hash value, within said set. 19. The method according to dispatching a given network address to all sets of mini-Bloom filters for distinct prefix lengths on a tri-state bus in said probing process. 20. The method according to 21. A system for performing a network address lookup, comprising:
means for sorting forwarding prefixes from a routing table by prefix length; means for associating each of a plurality of Bloom filters with a unique prefix length; means for programming each of said plurality of Bloom filters with said prefixes corresponding to said associated unique prefix length; and means for performing membership queries to said Bloom filters by using predetermined prefixes of an network address. 22. The system according to 23. The system according to 24. The system according to 25. The system according to 26. The system according to 27. The method according to 28. The system according to a direct lookup array for initial prefix lengths and asymmetric Bloom filters for the rest of the prefix lengths. 29. The system according to 30. The system according to means for utilizing CPE to reduce a number of said Bloom filters such that a maximum of two hash probes and one array access per network lookup is achieved. 31. The system according to 32. The system according to 33. The system according to means for uniformly distributing prefixes of a predetermined length across a set of mini-Bloom filters; and means for storing each of said prefixes in only one of said mini-Bloom filters. 34. The system according to means for calculating a primary hash value over said one of said prefixes. 35. The system according to means for storing said one of said prefixes in said one of said mini-Bloom filters pointed to by said primary hash value, within said set. 36. The system according to means for dispatching a given network address to all sets of mini-Bloom filters for distinct prefix lengths on a tri-state bus in said probing process. Description This patent application is a divisional of U.S. patent application Ser. No. 11/055,767, entitled “Method and System for Performing Longest Prefix Matching for Network Address Lookup Using Bloom Filters”, filed Feb. 9, 2005, which claims the benefit of U.S. provisional patent application 60/543,222, entitled “Method And Apparatus For Performing Longest Prefix Matching For In Packet Payload Using Bloom Filters,” filed on Feb. 9, 2004, each of which prior patent applications is incorporated herein by reference to the fullest extent allowable by law. This invention was made with government support under grants ACI-0203869, ANI-9813723, and ANI-0096052 awarded by the National Science Foundation. The government has certain rights in the invention. The present invention relates to network communication routing and, in particular, to a method and system of performing longest prefix matching for network address lookup using Bloom filters. Longest Prefix Matching (LPM) techniques have received significant attention due to the fundamental role LPM plays in the performance of Internet routers. Classless Inter-Domain Routing (CIDR) has been widely adopted to prolong the life of Internet Protocol Version 4 (IPv4). This protocol requires Internet routers to search variable-length address prefixes in order to find the longest matching prefix of the network destination address of each product traveling through the router and retrieve the corresponding forwarding information. This computationally intensive task, commonly referred to as network address lookup, is often the performance bottleneck in high-performance Internet routers due to the number of off-chip memory accesses required per lookup. Although significant advances have been made in systemic LPM techniques, most commercial router designers use Ternary Content Addressable Memory (TCAM) devices in order to keep pace with optical link speeds despite their larger size, cost, and power consumption relative to Static Random Access Memory (SRAM). However, current TCAMs are less dense than SRAM, and have access times of 100M random accesses per second, which are over 3.3 times slower than SRAMs (which are capable of performing 333,000,000 random accesses per second) due to the capacitive loading induced by their parallelism. Further, power consumption per bit of storage is four orders of magnitude higher than SRAM. Techniques such as the Trie-based systems, Tree Bitmap, Multiway and Multicolumn Search, and Binary Search on Prefix Length techniques may make use of commodity SRAM and SDRAM devices. However, these techniques have not met the criteria to provide advantages in performance that are independent of IP address length or to provide improved scalability. Therefore, a need exists for a method and system that overcome the problems noted above and others previously experienced. Methods and systems consistent with the present invention employ Bloom filters for Longest Prefix Matching. Bloom filters, which are efficient data structures for membership queries with tunable false positive errors, are typically used for efficient exact match searches. The probability of a false positive is dependent upon the number of entries stored in the filter, the size of the filter, and the number of hash functions used to probe the filter. Methods consistent with the present invention perform a network address lookup by sorting forwarding table entries by prefix length, associating a Bloom filter with each unique prefix length, and “programming” each Bloom filter with prefixes of its associated length. A network address lookup search in accordance with methods consistent with the present invention begins by performing parallel membership queries to the Bloom filters by using the appropriate segments of the input IP address. The result of this step is a vector of matching prefix lengths, some of which may be false matches. A hash table corresponding to each prefix length may then be probed in the order of longest match in the vector to shortest match in the vector, terminating when a match is found or all of the lengths represented in the vector are searched. One aspect of the present invention is that the performance, as determined by the number of dependent memory accesses per lookup, may be held constant for longer address lengths or additional unique address prefix lengths in the forwarding table given that memory resources scale linearly with the number of prefixes in the forwarding table. Methods consistent with the present invention may include optimizations, such as asymmetric Bloom filters that dimension filters according to prefix length distribution, to provide optimal average case performance for a network address lookup while limiting worst case performance. Accordingly, with a modest amount of embedded RAM for Bloom filters, the average number of hash probes to tables stored in a separate memory device approaches one. By employing a direct lookup array and properly configuring the Bloom filters, the worst case may be held to two hash probes and one array access per lookup while maintaining near optimal average performance of one hash probe per lookup. Implementation with current technology is capable of average performance of over 300M lookups per second and worst case performance of over 100M lookups per second using a commodity SRAM device operating at 333 MHz. Methods consistent with the present invention offer better performance, scalability, and lower cost than TCAMs, given that commodity SRAM devices are denser, cheaper, and operate more than three times faster than TCAM-based solutions. Specifically, in accordance with methods consistent with the present invention, a method of performing a network address lookup is provided. The method comprises: grouping forwarding entries from a routing table by prefix length; associating each of a plurality of Bloom filters with a unique prefix length; programming said plurality of Bloom filters with said associated set of prefixes; and performing membership probes to said Bloom filters by using predetermined prefixes of a network address. In accordance with systems consistent with the present invention, a system is provided for performing a network address lookup. The system comprises means for sorting forwarding entries from a routing table by prefix length, means for associating each of a plurality of Bloom filters with a unique prefix length, means for programming said plurality of Bloom filters with said associated set of prefixes, and means for performing membership queries to said Bloom filters by using predetermined prefixes of an network address. Other systems, methods, features, and advantages of the present invention will be or will become apparent to one with skill in the art upon examination of the following figures and detailed description. It is intended that all such additional systems, methods, features, and advantages be included within this description, be within the scope of the invention, and be protected by the accompanying claims. Methods consistent with the present invention employ a LPM technique that provides better performance and scalability than conventional TCAM-based techniques for IP network address lookup. The present invention exhibits several advantages over conventional techniques, since the number of dependent memory accesses required for a lookup is virtually independent of the length of the IP network address and the number of unique prefix lengths (in other words, statistical performance may be held constant for arbitrary address lengths provided ample memory resources). Scaling the present invention to IPv6 does not degrade lookup performance and requires more on-chip memory for Bloom filters only if the number of stored unique prefix lengths increases. Although logic operations and accesses to embedded memory increase operating costs, the amount of parallelism and embedded memory employed by the present invention are well within the capabilities of modern Application-Specific Integrated Circuit (“ASIC”) technology. Finally, by avoiding significant precomputation, such as typically exhibited using a known “leaf pushing” technique, the present invention is able to retain its network address lookup performance even when the network prefix databases are incrementally updated. In general, each Bloom filter Querying the Bloom filters In the derivation of the false positive probability (i.e., for a message that is not programmed, all k bits that it hashes to are 1), the false probability that a random bit of the m-bit vector is set to 1 by a hash function is simply 1/m. The probability that it is not set is 1−(1/m). The probability that it is not set by any of the n members of X is (1−(1/m)) For large values of m, the above equation approaches the limit: This explains the presence of false positives in this scheme, and the absence of any false negatives. Because this probability is independent of the input message, it is termed the “false positive” probability. The false positive probability may be reduced by choosing appropriate values for m and k for a given size of the member set, n. It is clear that the size of the bit-vector, m, needs to be quite large compared to the size of the message set, n. For a given ratio of m/n, the false positive probability may be reduced by increasing the number of hash functions, k. In the optimal case, when false positive probability is minimized with respect to k, the following relationship is obtained:
The ratio m/n may be interpreted as the average number of bits consumed by a single member of the set of messages. It should be noted that this space requirement is independent of the actual size of the member. In the optimal case, the false positive probability is decreased exponentially with a linear increase in the ratio m/n. In addition, this implies that the number of hash functions k, and hence the number of random lookups in the bit vector required to query membership of one message in the set of messages is proportional to m/n. The false positive probability at this optimal point (i.e., false positive probability ratio) is:
If the false positive probability is to be fixed, then the amount of memory resources, m, needs to scale linearly with the size of the message set, n. One property of Bloom filters is that it is not possible to delete a member stored in the filter. Deleting a particular message entry from the set programmed into the Bloom filter To overcome this drawback, each Counting Bloom filter The counters are changed only during addition and deletion of prefixes in the Bloom filter. These updates are relatively less frequent than the actual query process itself. Hence, counters may be maintained in software and the bit corresponding to each counter is maintained in hardware. Thus, by avoiding counter implementation in hardware, memory resources may be saved. An important property of Bloom filters is that the computation time involved in performing the query is independent from the number of the prefixes programmed in it, provided, as stated above, that the memory m used by the data structure varies linearly with the number of strings n stored in it. Further, the amount of storage required by the Bloom filter for each prefix is independent from its length. Still further, the computation, which requires generation of hash values, may be performed in special purpose hardware. The present invention leverages advances in modern hardware technology along with the efficiency of Bloom filters to perform longest prefix matching using a custom logic device with a modest amount of embedded SRAM and a commodity off-chip SRAM device. A commodity DRAM (Dynamic Random Access Memory) device could also be used, further reducing cost and power consumption but increasing the “off-chip” memory access period. In the present invention, by properly dimensioning the amount and allocation of embedded memory for Bloom filters In one implementation, the plurality of IP address Although the bit-vectors associated with each Bloom filter The hash table Using the approximation that probing a hash table A network address lookup search executed by the system For example, for packets following IPv4, when the input address produces matches in the Bloom filters The network address lookup search executed by the system The number of hash probes required to determine the correct prefix length for an IP address is determined by the number of matching Bloom filters
For each value of i, i additional hash probes are required. Hence, the expected number of additional hash probes required when matching a length l prefix is:
which is the mean for a binomial distribution with B The equation above shows that the expected number of additional hash probes for the prefixes of a particular length is equal to the number of Bloom filters for the longer prefixes times the false positive probability (which is the same for all the filters). Let B be the total number of Bloom filters in the system for a given configuration. The worst case value of E This is the maximum number of additional hash probes per lookup, independent of input address (e.g., IP address where the additional one probe accounts for the probe at the matching prefix length. However, there is a possibility that the IP address Thus, Equation 9 gives the expected number of hash probes for a longest prefix match, and Equation 10 provides the maximum number of hash probes for a worst case lookup. Since both values depend on B, the number of filters Accordingly, the system Several variables affect system performance and resource utilization: N, the target amount of prefixes supported by the system; M, the total amount of embedded memory available for the Bloom filters; W, the number of unique prefix lengths supported by the system; m k n For clarity in the discussion, IPv4 addresses (e.g., IP address As long as the false positive probability is kept the same for all the Bloom filters
This implies that: Therefore, the false positive probability f Based on the preceding analysis, the expected number of hash probes executed by the system The preceding analysis indicates that memory (not shown in figures) may be proportionally allocated to each Bloom filter In an exemplary static system configured for uniformly distributed prefix lengths to search a database with non-uniform prefix length distribution, some filters are “over-allocated” to memory while others are “under-allocated.” Thus, the false positive probabilities for the Bloom filters are no longer equal. In this example, the amount of embedded memory per filter is proportionally allocated based on its current share of the total prefixes and the number of hash functions is adjusted to maintain a minimal false positive probability. This exemplary configuration is teemed “asymmetric Bloom filters”, and a device architecture capable of supporting it is discussed below. Using Equation 9 for the case of IPv4, the expected number of hash probes per lookup, E Given the feasibility of asymmetric Bloom filters, the expected number of hash probes per lookup, E The preceding analysis illustrates how asymmetric Bloom filters Since the distribution statistics shown in One implementation of the direct lookup array device For example, a=20 results in a direct lookup array
where N On average, the N A high-performance implementation option for the system The number of remaining Bloom filters Likewise, it is shown for example, in all of the sample databases, that prefixes in the 25 to 32 range are extremely sparse. Specifically, 0.2% of the N prefixes fall in the range 25 to 32. (Note that 24.6% of the prefixes fall in the range of 1 to 20.) Based on these observations, in one implementation of the system
Using the observed average distribution of prefixes and observed average values of α The following provides simulation results for each of three embodiments of system -
- Scheme 1: This first exemplary scheme is the system
**100**configuration which uses asymmetric Bloom filters**101**for all prefix lengths as described previously; - Scheme 2: This second exemplary scheme that may be employed by system
**100**uses a direct lookup array device**112**for prefix lengths [**1**. . .**20**] and asymmetric Bloom filters**101**for prefix lengths [**21**. . .**32**] as described previously; and - Scheme 3: This third exemplary scheme that may be employed by system
**100**uses a direct lookup array device**112**for prefix lengths [**1**. . .**20**] and two asymmetric Bloom filters**101**for CPE prefix lengths**24**and**32**which represent prefix lengths [**21**. . .**24**] and [**25**. . .**32**], respectively, as described above.
- Scheme 1: This first exemplary scheme is the system
For each of the three schemes, M=2 Mb, for example, and m, is adjusted for each asymmetric Bloom filter In order to investigate the effects of input addresses on system Maximum false positives were observed when the traffic pattern consisted of only the IP addresses corresponding to the prefixes in the database. Hence, the following results correspond to this input traffic pattern. The average number of hash probes per lookup from the test runs with each of the databases on all three schemes or system
Using Scheme 3 or the third system At the same time, Scheme 3 had a worst case performance of 2 hash probes and one array access per lookup. Assuming that the array A direct comparison was made between the theoretical performance and observed performance for each scheme or system Thus, the number of dependent memory accesses per lookup may be held constant given that memory resources scale linearly with database size. Given this characteristic of the system In order to assess the current state of IPv6 tables, five IPv6 BGP table snapshots were collected from several sites. Since the tables are relatively small, a combined distribution of prefix lengths was computed. IPv6 unicast network addresses may be aggregated with arbitrary prefix lengths like IPv4 network addresses under CIDR. Although this provides extensive flexibility, the flexibility does not necessarily result in a large increase in unique prefix lengths. The global unicast network address format has three fields: a global routing prefix; a subnet ID; and an interface ID. All global unicast network addresses, other than those that begin with 000, must have a 64-bit interface ID in the Modified EUI-64 format. These interface IDs may be of global or local scope; however, the global routing prefix and subnet ID fields must consume a total of 64 bits. Global unicast network addresses that begin with 000 do not have any restrictions on interface ID size; however, these addresses are intended for special purposes such as embedded IPv4 addresses. Embedded IPv4 addresses provide a mechanism for tunneling IPv6 packets over IPv4 routing infrastructure. This special class of global unicast network addresses should not contribute a significant number of unique prefix lengths to IPv6 routing tables. In the future, IPv6 Internet Registries must meet several criteria in order to receive an address allocation, including a plan to provide IPv6 connectivity by assigning /48 address blocks. During the assignment process, /64 blocks are assigned when only one subnet ID is required and /128 addresses are assigned when only one device interface is required. Although it is not clear how much aggregation will occur due to Internet Service Providers assigning multiple /48 blocks, the allocation and assignment policy provides significant structure. Thus, IPv6 routing tables will not contain significantly more unique prefix lengths than current IPv4 tables. Accordingly, systems and methods consistent with the present invention provide a longest prefix matching approach that is a viable mechanism for IPv6 routing lookups. Due to the longer “strides” between hierarchical boundaries of IPv6 addresses, use of Controlled Prefix Expansion (CPE) to reduce the number of Bloom filters The ability to support a lookup table of a certain size, irrespective of the prefix length distribution is a desirable feature of the system In this implementation, instead of allocating a fixed amount of memory to each of the Bloom filters In the membership query process, a given IP address is dispatched to all sets of mini-Bloom filters Since the prefix is hashed or probed in only one of the mini-Bloom filters The number of hash functions k, is essentially the lookup capacity of the memory storing a Bloom filter For designs with values of k higher than what may be realized by technology, a single memory with the desired lookups is realized by employing multiple smaller memories, with fewer ports. For instance, if the technology limits the number of ports on a single memory to 4, then 2 such smaller memories are required to achieve a lookup capacity of 8 as shown in In general, if h is the maximum lookup capacity of a RAM as limited by the technology, then k/h such memories of size m/(k/h) may be combined to realize the desired capacity of m bits and k hash functions. When only h hash functions are allowed to map to a single memory, the false positive probability may be expressed as: Comparing equation 18 with equation 2, restricting the number of hash functions mapping to a particular memory, does not affect the false positive probability provided the memories are sufficiently large. Accordingly, a Longest Prefix Matching (LPM) system consistent with the present invention employs Bloom filters to efficiently narrow the scope of the network address lookup search. In order to optimize average network address lookup performance, asymmetric Bloom filters It should be emphasized that the above-described embodiments of the invention are merely possible examples of implementations set forth for a clear understanding of the principles of the invention. Variations and modifications may be made to the above-described embodiments of the invention without departing from the spirit and principles of the invention. All such modifications and variations are intended to be included herein within the scope of the invention and protected by the following claims. Referenced by
Classifications
Legal Events
Rotate |