Packet classification using fingerprint hash table

A method comprising:

• determining a key based on a data packet;
• applying a fingerprint hash function to the determined key to generate a fingerprint of the determined key, the fingerprint comprising a number of bits;
• determining an index value based on a portion of the bits of the fingerprint;
• accessing a memory location associated with the index value to determine whether the memory location stores remaining bits of the fingerprint other than the portion of the bits of the fingerprint;
• handling the data packet according to packet handling metadata associated with the fingerprint, where the memory location stores the remaining bits of the fingerprint,
• wherein the packet handling metadata is determined by a network security device,
• wherein the packet handling metadata indicates packet handling for a set classification of the data packet that is derived from the determined key,
• wherein the set classification is among a plurality of set classifications,
• wherein the memory location comprises a memory location in a Dual In-line Memory Module (DIMM), the DIMM comprising multiple Dynamic Random Access Memory (DRAM) devices in parallel, and wherein the accessing comprises reading from the DIMM using a burst length BL according to the following relationship:
• BL≥S*(F*+A)/N_DIMM
• where
• S is a number of slots in the memory location,
• F* is a number of the remaining bits of the fingerprint,
• A is a number of bits of the packet handling metadata,
• N_DIMM is a width of the DIMM.

An apparatus comprising:

• a memory;
• and
• a processor, coupled to the memory, to:
• determine a key based on a data packet;
• apply a fingerprint hash function to the determined key to generate a fingerprint of the determined key, the fingerprint comprising a number of bits;
• determine an index value based on a portion of the bits of the fingerprint;
• access in the memory a memory location associated with the index value to determine whether the memory location stores remaining bits of the fingerprint other than the portion of the bits of the fingerprint;
• handle the data packet according to packet handling metadata associated with the fingerprint, where the memory location stores the remaining bits of the fingerprint,
• wherein the packet handling metadata is determined by a network security device,
• wherein the packet handling metadata indicates packet handling for a set classification of the data packet that is derived from the determined key,
• wherein the set classification is among a plurality of set classifications,
• wherein the memory comprises a Dynamic Random Access Memory (DRAM), and wherein the processor is configured to access the memory by reading from the DRAM using a burst length BL according to the following relationship:
• BL≥S*(F*+A)/N
• where
• S is a number of slots in the memory location,
• F* is a number of the remaining bits of the fingerprint,
• A is a number of bits of the packet handling metadata,
• N is a width of the DRAM.

An apparatus comprising:

• a memory;
• and
• a processor, coupled to the memory, to:
• determine a key based on a data packet;
• apply a fingerprint hash function to the determined key to generate a fingerprint of the determined key, the fingerprint comprising a number of bits;
• determine an index value based on a portion of the bits of the fingerprint;
• access in the memory a memory location associated with the index value to determine whether the memory location stores remaining bits of the fingerprint other than the portion of the bits of the fingerprint;
• handle the data packet according to packet handling metadata associated with the fingerprint, where the memory location stores the remaining bits of the fingerprint,
• wherein the packet handling metadata is determined by a network security device,
• wherein the packet handling metadata indicates packet handling for a set classification of the data packet that is derived from the determined key,
• wherein the set classification is among a plurality of set classifications,
• wherein the memory comprises a Dual In-line Memory Module (DIMM), the DIMM comprising multiple Dynamic Random Access Memory (DRAM) devices in parallel, and wherein the processor is configured to access the memory by reading from the DIMM using a burst length BL according to the following relationship:
• BL≥S*(F*+A)/N_DIMM
• where
• S is a number of slots in the memory location,
• F* is a number of bits of the remaining bits fingerprint,
• A is a number of bits of the packet handling metadata,
• N_DIMM is a width of the DIMM.