A SET-BASED APPROACH TO PACKET CLASSIFICATION

Firewalls, and packet classification in general, are becoming more and more significant as data rates soar and hackers become increasingly sophisticated and more forceful. In this paper, we present a new packetclassification approach that uses set theory to classify packets. This approach has significant theoretical advantages over current approaches. We demonstrate its practicality by implementing a firewall subsystem in Linux which approaches the performance of today’s naive packet-filtering implementations.