設計與實作狀態化封包內容分類器的描述語言、編譯器，與引擎

Design and Implementation of Script Language, Compiler, and Engine for Stateful Content-Based Packet Classification

黃仲君(Chung-Chun Huang)

指導教授 ： 孫雅麗

國立臺灣大學/管理學院/資訊管理學研究所/碩士(2004年)

https://doi.org/10.6342/NTU.2004.01580

摘要

本論文所提出的狀態化封包內容分類架構，相較於傳統的封包分類器，具有應用層內容檢視、動態的通訊協定狀態紀錄與維持，以及能夠同時處理IPv4/IPv6封包的特點。
整個系統的架構，首先是從研究多種目前常見的通訊協定與應用服務之規格開始，再歸納出在檢視封包標頭與應用層內容時會使用的比對特徵，進而設計合適的描述語言(Script Lan-guage)。描述語言要涵豪為鱆漱髀黻捊

關鍵字

內容檢視 ； 狀態 ； 封包分類

並列摘要

In this thesis, the architecture of stateful content-based packet classification is proposed. Compared to the traditional packet classifier, this architecture is capable to inspect the packet application content, maintain and track the protocol state transition dynamically, and handle both IPv4 and IPv6 packets.
At first, we study the specification of numerous protocols and applications in wide-spread use. We generalize their features which are commonly utilized when inspecting the packet header and application content, and then Script Language is designed. Script Lan-guage has to cover sufficient types of matches to satisfy the requirements for convenience and flexibility. Next, Script Language Compiler compiles Script Language into codes which store the rule specifications into the rule table. Along with the rule table, Stateful Con-tent-based Classification Engine therefore can perform the procedure of packet classification. Classification Engine comprises several functional components. Separating the filtering pro-cedure into multiple stages is one of the features of Classification Engine. Each stage is im-plemented as different building blocks consistent with the characteristics of the matches. In addition, classification engine maintains and tracks the state transition of protocols in order to understand the evolution of connections.
The architecture we proposed not only meets the requirements of current packet classi-fication (stateful and content inspection), but also brings up some original ideas and design.

並列關鍵字

Stateful ； Packet Classifier ； Packet Classification ； Content Inspection

參考文獻

[2] F. Baboescu and G. Varghese, “Scalable Packet Classification”, In proceedings of ACM SIGCOMM Conference, 2001

[5] S. Deering and R. Hinden, “Internet Protocol, Version 6 (IPv6) Specification”, RFC 2460, December 1998

[6] S. Dharmapurikar, P. Krishnamurthy, T. Sproull, and J. Lockwood, “Deep Packet In-spection using Parallel Bloom Filters”, In Proceedings of the IEEE Symposium on High Performance Interconnects, 2003

[7] Knuth D. E., Morris (Jr) J. H., and Pratt V. R., “Fast pattern matching in strings”, SIAM Journal on Computing, 1977

[8] eDonkey Protocol Specification, http://sourceforge.net/projects/pdonkey/