f we need to look into the payload. We introduce delay and delay variability into the classification process. Deep Packet Content: Switching packets by user activity and content- Classification Application HTTP GET request, URL and Cookie - Presentation Session Multifield: Switching packets by flows - Transport IPC addresses and TCP ports Network Single Field: Switching packet by address - IP address, MAC fields Data Link IP Header Protocol complexity and session complexity have a direct Physical impact on classification complexity, which in turn determines Classification the complexity of the networking device. Figure 17.4 Multilayer classification. Network Software - The User Experience Don't Care Header Match Payload Result Don't Care Header Payload Match Result Figure 17.5 Header versus data payload searches. The whole process of classification means we have to put the packet somewhere while we examine it. As we move down the protocol stack we need better and better performance from our memory and we can find we end up spending large sums of money, particularly when provisioning S-RAM and CAM (content-addressable memory). Note that these memory overheads are in addition to the buffer memory needed for queue management (prior to accessing egress bandwidth from the router). Figure 17.6 illustrates these classification memory overheads. Note also that both classification and queue memory need to be substantially overprovisioned to deal with asynchronous and (at times) highly asymmetric traffic. The end result is that router hardware and router software will cost more than expected and perform less well than expected. Content: Switching packets by user activity and content - Application HTTP GET request, URL and Cookie Presentation Session Multifield: Switching packets by flows- S-RAM Transport IPC addresses and TCP ports Network Single Field: Switching packet by address - IP address, MAC fields Data Link Protocol complexity and session complexity have a direct Physical impact on classification complexity, which 