Eecient Demultiplexing of Network Packets by Automatic Parsing Eecient Demultiplexing of Network Packets by Automatic Parsing

Packet lters are a mechanism for eeciently demultiplexing network packets to application endpoints. There is currently no general, formal speciication method for packet lters that allows for easy or eecient composition of speciications. In this paper we present an automatic approach that achieves all of these goals. We approach packet lter speciication as a language recognition problem: each lter is represented by a context-free grammar, whose language is the set of packets the lter should accept. Thus, packet lters can be formulated through a general, well deened speciication; further, the grammar-based approach simpliies lter composition, which is essential where scalability is important. However packet lters based on standard LR parsing techniques suuer from poor performance: they touch every portion of the input, they check input bit by bit, they occupy large amount of space. We present new optimizations to LR parsing that enable our automatic approach to overcome the above problems and achieve performance rivalling hand-crafted approaches. We present results that compare our approach to the BSD packet lter for TCP connections; our approach shows signiicant improvement when there are multiple lters installed: for 50 TCP connections our approach is 6 times faster.