## 5 Delays within a Domain
### Processing of Rules  
To prove the possibility of this being applied in practice the processing of the rules has been investigated. ACLs provide a very simple decision process since for every packet tested there are only 2 possibilities, permit or deny which are defined by the first rule match.  
When considering all the rules in an ACL it is possible to represent the result for all possible IPv4 packets by constructing an array which contains a bit representing each possible IP address Figure 11. As there are 23 possible IP addresses then such an array will require approx 512 Mbytes of memory. This was done by developing a custom-built data structure to store the bit values for each possible IP address.  
Figure 10: Optimizing rules across a domain.  
address. The contents of the array is initially set to reflect all addresses being denied which corresponds to the implicit \"deny any any\" statement found at the end of all ACLs. If a \"permit any any\" statement specified before the \"deny any any\" then it would be prudent to populate the array in the opposite sense, all addresses being permitted instead of all denied, hence increasing the time taken for the array to be populated.  
The process starts by using the ACL found at the ingress point of the domain the array is populated with the filtering action for each possible IPv4 packet. The rules are evaluated starting from the bottom of the list since the priority of a rule increases for rules higher in the list. Figure 10 shows the process, for each router hop containing an ACL along the network path the array is rewritten based on the rules defined in each ACL. When the first rule in the ACL has been reached then the array reflects all the rules of the ACL. It is now necessary to modify the contents of the array created to reflect the rules found in the ACLs of the next router in the path. This process is continued until the final point in the domain is reached. The final content of the array represents the security policy for that route through the domain.  
In this example, Router A represents the final router for the network path and Router C is the ingress router for the domain. Using the techniques described an equivalent rule set is created which is placed on Router A. The set of packets which can be forwarded by Router A is identical. However the removal of ACLs on Routers B and C considerably reduces the latency for a packet traversing that particular route. The security policy is represented as a byte array of 2\({}^{24}\) elements. Since this example is based on standard ACLs this provides sufficient space to store the action taken for every possible  
Figure 11: Building array.  
IPv4 packet (\(2^{24}\times 8\)). The IPv4 address is used as an array index when accessing a particular IP address value. For example the first element in the array maps to the IP address 0.0.0.0 and the last element to the IP address 255.255.255. The reverse transformation of the array is relatively trivial, using the same mapping technique in reverse it is possible to construct a rule set which consists of individual rules for each address value.  
An intermediate step can be performed to merge rules into larger ranges providing they have the same filtering action. Appropriate masks are generated to represent the merged address ranges for all rules within the ACL. Due to the use of contiguous masks in most packet filtering schemes there are restrictions which limit the number of rules that can be merged. Each time a change is made in the security policy for a particular path through the domain it would be necessary to repeat the above steps to obtain a new ACL which reflects the contents of the rewritten array for each path affected by the change.