Jay Eye Sea

Ian Leader: Something of a blast from the past: as part of my recent job change, I had to dig out and scan the write up of final year BA Computer Science project, ‘An Optimised Network Packet Filter’ (click to view or download PDF) that I presented at Cambridge University in 1994.

Network packet filters were ‘in’ around this time, as part of the then trend towards microkernel operating systems. The idea was that you move as much as possible out of the kernel into user process/memory space, so that it was easier to modify. The network packet filter would identify and extract the content from all network packets and dispatch them to the appropriate user process.

However, two factors subsequently turned the tide and networking code back into the kernel:

1. the growth of the Internet and the corresponding importance of high performance networking
2. the lack of any real need to modify packet handling on a regular or ad-hoc basis outside of academic environments (everyone uses some form of Ethernet and UDP/TCP pretty much all the time, and not much else)

The project focused on optimizing the process of identifying and decoding packets – basically building a list of patterns to match for an applying them efficiently against incoming packets. In theory, the algorithms I applied worked pretty well compared to existing approaches, but I was never able to do any real world testing. This was partly due to time constraints on the project, but also due to the security culture in the computer lab at the time, which basically amounted to:

• Never let a (undergraduate) student have root
• Don’t let a student see any of the UNIX (DEC Ultrix in our case) source code related to security or the kernel
• Don’t let a students access the network with their own device

So I wasn’t even allowed to do my own promiscuous network sniffing to get real data to test against – my supervisor had to do it! Universities might still be like this except for Linux!

The project was supervised by Derek McAuley who was a great teacher and mentor. The original, complete with typos (the OCR ate them when I scanned it) and my grade (can you guess?) can be found in the library of the computer lab at Cambridge.