Partitioning a filter to facilitate filtration of packets

#Packets being received and/or provided via a network may be filtered by a firewall (e.g., a firewall device, a firewall software, a packet processing engine, etc.). The firewall may filter the packets based on filter rules that associate packet information (e.g., a source of the packets, a destination of the packets, protocols associated with the packets, etc.) with actions to perform on the packets.

#According to some possible implementations, a method may include obtaining a match vector that indicates one or more filter rules that are potentially applicable to a packet that is received by a device. The one or more filter rules may be included in a filter that includes a plurality of filter rules. The method may include partitioning the match vector into a plurality of segments. The method may include generating a summary vector that identifies one or more portions of the match vector that include one or more match bits. A match hit, of the one or more match bits, may indicate one of the one or more filter rules that is potentially applicable to the packet. The method may include obtaining a relevant segment of the match vector. The relevant segment may include at least one of the one or more portions of the match vector identified by the summary vector. The method may include determining a particular filter rule, of the one or more filter rules, to apply based on the one or more portions of the match vector and based on the one or more match bits. The method may include applying the particular filter rule to the packet.

#According to some possible implementations, a device may include one or more processors. The one or more processors may generate a filter based on a filter specification. The filter specification may identify a plurality of filter rules. The plurality of filter rules may be included in the filter. The one or more processors may identify one or more filter rules of the plurality of filter rules that are potentially applicable to a packet. The one or more processors may generate a match vector that identifies the one or more filter rules that are potentially applicable to the packet. The match vector may identify the one or more filter rules using one or more match bits. A match bit, of the one or more match bits, may indicate one of the one or more filter rules that is potentially applicable to the packet. The one or more processors may partition the match vector into segments. The one or more processors may generate a summary vector that identifies one or more portions of the match vector that include at least one match bit. The one or more portions of the match vector may be included in one or more of the segments. The one or more processors may obtain, based on the summary vector, a relevant segment of the one or more segments. The relevant segment may be a segment that includes one or more of the portions. The one or more processors may identify a match bit in the relevant segment that corresponds to a particular filter rule of the one or more filter rules. The match bit may indicate that the particular filter rule is applicable to the packet. The one or more processors may apply the particular filter rule to the packet.

#FIG. 1A-1C are diagrams of an overview of an example implementation described herein;

#FIG. 2 is a diagram of an example environment in which systems and/or methods, described herein, may be implemented;

#FIG. 3 is a diagram of example components of one or more devices of FIG. 2;

#The following detailed description of example implementations refers to the accompanying drawings. The same reference numbers in different drawings may identify the same or similar elements.

#A firewall (e.g., a firewall device, a firewall software application, a packet processing component, etc.) may filter network traffic (e.g., packets) based on a set of filter rules, referred to herein as a filter. A filter rule of the filter may specify packet information (e.g., a source Internet Protocol (IP) address of a packet, a destination IP address of the packet, a protocol associated with the packet, a source network port of the packet, a destination network port of the packet, etc.), and may indicate one or more actions to perform on packets that match the packet information. If a packet matches the packet information, the firewall may perform the one or more actions and/or cause the one or more actions to be performed on the packet.

#The firewall may be unable to implement filters larger than a certain size and/or filters that contain a certain quantity of filter rules. For example, hardware of a firewall may limit a quantity of filter rules that the firewall may enforce based on restrictions imposed by size of components, heat generation, and/or performance limitations. As another example, software of a firewall may suffer increased latency as the firewall software enforces an increasing quantity of rules. The firewall may also be incapable of reading, storing, compressing, and/or decompressing vectors of a particular size, which may further limit the size of filter that the firewall may enforce. Implementations described herein may enable a firewall to partition a large filter into segments that the firewall is capable of efficiently processing, which may improve latency of the firewall and enable the firewall to enforce filters that include an increased quantity of rules. Further, implementations described herein may reduce an amount of storage space used to enforce a filter of arbitrary size.