3 ms·
then what would happen if you had to do the same thing with ipv6?
by stargrazer 4y ago
then what would happen if you had to do the same thing with ipv6?
- justinjlynn 4y agoOr layer 7/stateful firewalls...
- fulafel 4y agoSame kind of four-tuples, just with 128 bit numbers instead of 32 bit ones for the addresses. If you wanted to do this for a gazillion rules and micro-optimize memory use, you could use indexed ip references in the memory representation, same way as vertices are addressed in GPU programming - would help for v4 as well.
- jiggawatts 4y agoIPv6 would work the same way, because it is a finite space and the number of distinct ranges is low, because firewall rule tables are generally quite small (megabytes!). The ranges are not some "noisy" set, but large blocks. Thinking about it, any tree-like data structure that includes a compression designed for handling long run-lengths would work just fine. For example, a minor variation of roaring bitmaps would suffice. However, another reply mentioned layer 7 firewalls, which can potentially understand DNS, HTTP headers, and apply regular expressions. Those would not be possible using this kind of naive data structure and would definitely require something like Z3.