Fast network layer packet filter

Abstract

A new packet filtering system associates domain identifiers with respective sets of addresses. A set of domain prefixes defines the set of addresses associated with a given domain identifier. Domain prefixes are found matching the source address and destination address of each received packet. These prefixes are associated with a source domain identifier and destination domain identifier respectively. The system similarly associates sets of one or more protocol types and port ranges with respective protocol domain identifiers. The protocol type, source port and destination port of the received packet determine source and destination protocol domain identifiers for the received packet. The system includes a filtering matrix including one or more entries, each indicating whether an associated received packed should be filtered. The source domain identifier, destination domain identifier, and source and destination protocol domain identifiers are used to index into the filtering matrix, for example using each as an index into one of the dimensions of a four dimensional array used to implement the filtering matrix. In an alternative embodiment, the source and destination protocol identifiers are used to obtain a protocol index from a protocol vector data structure. The protocol index, source domain identifier and destination identifier are then used to index into a three dimensional filtering matrix. The system further optimizes the filtering matrix for size, and the lookup time is dependent only on the number of filtering domains, and not the complexity or number of filtering rules.