ECE 526 – Network
Processing Systems Design
Packet Processing I: algorithms and data
Chapter 5: D. E. Comer
• Understand basic packet processing operations
• Learn how to design efficient network processing system
─ Optimized data structures
─ Optimized processing algorithms
• Get ready for Lab1
Ning Weng
ECE 526
• Packet processing data structures
─ Data storage
─ Linked list
─ Hash
• Packet processing algorithms
Ethernet bridge
Table lookup and hashing (used for lab1)
Packet flow classification (used for lab1)
IP forwarding, fragmentation and reassembly -- next
TCP connection recognition and splicing - next
• Lab 1
Ning Weng
ECE 526
Data Storage: coping & buffering
• Used when packet moved from one memory location to
another for protocol processing
─ Expensive, why?
─ What can be done to reduce buffer copies?
• Must be avoided whenever possible
─ Leave packet in buffer
─ Pass buffer address among threads/layers
• Buffer allocation
─ Large, fixed buffer
─ Varied-size buffers
─ Linked list of fixed-size blocks
• What size should buffers be?
Ning Weng
ECE 526
Buffer Sizes
• Max IP packet size is 64KB (total length field in IP
format: 16 bit)
• Almost no packets larger than 1500 bytes
Ning Weng
ECE 526
Ethernet Bridge
Used between a pair of Ethernets
Provides transparent connections
Listens in promiscuous mode
Forwards frames in both directions
Uses source address in frames to identify computers on
each network
• Uses addresses to filter
─ Uses destination address to decide whether to forward frame
Ning Weng
ECE 526
Learning Bridge Algorithm
Forwarding unless the destination is known lie on the segment over which
frames arrives
Ning Weng
ECE 526
Hash Table Lookup
• Table lookup
─ Need high speed
─ Software-based systems use hashing for table lookup
• Hashing:
─ Scheme for providing rapid access to data items which are distinguished by
some key
• Hash table and hash function
• Hashing function
─ Function assigns a data item distinguished by some “key” into one of a
number of possible “hash buckets” in a hash table
─ Ideal hash function should distribute items evenly between the buckets
• Hashing collision
─ Two different items hash to the same location in a hash table
─ Double hashing: one of popular collision resolution technique
• Two values: one as a starting value and one as interval between successive
Ning Weng
ECE 526
Hashing Algorithm
Ning Weng
ECE 526
Packet Classification
• Process of mapping a packet to one of the finite sets of
“flows” or categories
• Flow – set of packets that share common characteristics,
for example
─ to the same destination
─ use the same procedure to process
• Packets can be classified according to packet header
Ning Weng
ECE 526
Example: Web Traffic
• Ethernet frame contains IP datagram
• IP datagram contains TCP segment
• TCP segment has destination port 80 (HTTP)
Ning Weng
ECE 526
Flow Creation
• 5-tuple: most commonly used version (also for lab1)
Ning Weng
ECE 526
Flow Creation: major steps
• Extract the five tuples from packet header
• Calculate the hash value of the five tuples using function
• Follows the concept of hashing algorithm
─ to find the right slot: either empty or the one has the same
hashing value but also same five tuples
─ different way to compute hash value
─ different way to resolve the collision
Ning Weng
ECE 526
Lab 1
• TCP/IP flow identification
• Your program should read a trace of packets and tell the
following statistics at the end of the run
─ Number of flows observed. That is the number of unique 5-tuples
consisting of IP source and destination, layer 4 protocol number,
and source and destination ports.
• We provide you with support functions to read and write
packet trace
─ You just need to write partial “packet processing code” based on
the guidance.
Ning Weng
ECE 526
Lab 1
• Modify file “flowid.c” only
• Three key functions:
─ Init_flowid()
• Initialize any data structures that you need
• You don’t need modify it, but you need understand it
─ Int flowid(packet *pass_packet)
• Packet processing code
• You need modify the partial code
─ Finish_flowid()
• Called at the end of trace, so you can output results
• You need modify this code
Ning Weng
ECE 526
Lab 1: Help
• Help:
─ Dr. Weng Office Hours: (MW 2:30 pm to 3:30 pm)
─ TAs: Kajal P. Patil and Mini Mathew [email protected],
[email protected]
─ Help Hours: Tu: 11:00am-1:00pm; Tr: 9:30-11:30am and Fr: 1-3pm
Ning Weng
ECE 526
For Next Class
• Read Comer Chapter 5
Ning Weng
ECE 526
• Note: (Please write clearly as you can; only a few key
words required for each question)
• Why packet processing is more and more important
compared with other sources of packet delay? Hint: think
about the technology/application trend, and the way to
reduce each of them.
• Why is hashing table efficient for table lookup? Can
hashing table be used for layer 2 lookup? How about for
layer 3? Please explain to support why and why not.
• What is the basic idea of optimize NIC? List of three
techniques of using this idea.
Ning Weng
ECE 526