The Price of Auditing a Firewall: Query Complexity of Black-Box Verification for Listed-Rule and Tree-Rule Policies

1. Introduction

A firewall [1] is, to everyone outside the administrator's console, a black box: a packet goes in and either comes out or does not. Three communities interrogate that black box every day. Auditors and compliance testers send probe packets to check that a deployed policy still matches its specification. Penetration testers and attackers send probe packets to reconstruct a policy they cannot read. And researchers have built a substantial literature on policy reconstruction by active probing [2,3,4,5] and on test-packet generation for network verification [6,7], each demonstrating that a policy can be recovered or tested "in feasible time with acceptable accuracy" [3]. To the best of our knowledge, none of this work states the question a complexity theorist would ask first: what is the minimum number of probes that the task requires, and what property of the policy governs that number?

The question is not academic. Configuration errors are common [8,9] and probe budgets are real: an auditor's maintenance window is finite, an attacker's probes trigger detection thresholds, and cloud APIs rate-limit how many security-group evaluations one may request. Without lower bounds one cannot know whether a probing tool is close to optimal, whether a certification suite is complete, or whether a policy design makes reverse engineering harder or easier.

1.1. What We Do

We formalize black-box firewall verification as an exact-learning problem [10] over the header space H = ∏_j [W_j] (for the IPv4 5-tuple, |H| = 2¹⁰⁴). A policy is a function f : H → {allow, deny}; a listed-rule (LR) policy represents f as a first-match list of n boxes; a Tree-Rule (TR) policy [11,12,13] represents f as a decision tree of depth d whose leaves partition H into m boxes. The observer may issue membership queries (MQ: send a packet, see the action), identity queries (IDQ: additionally learn which rule or leaf matched, as an auditor can via hit counters or flow logs), and may hold witness packets — one packet known to fall in each rule's effective region, as obtained from a few seconds of captured traffic. We study three tasks: LEARN (reconstruct f exactly), VERIFY (decide f ≡ g for a given specification g), and AUDIT-CERT (the smallest fixed set of packets that certifies f ≡ g against a class of deviations).

1.2. Results

Contributions at a glance. The main results are the following; the paragraphs that follow give the precise statements.

(1) Invisibility (Lemma 1). Shadowed rules leave no trace in any black-box transcript; redundancy, rule order and rule count leave none in an action-only transcript. Detecting shadowed rules from outside the box is therefore impossible for any black-box observer, and detecting redundancy, rule order or rule count is impossible for any action-only one; anomaly analysis is white-box by necessity, not merely by convention.

(2) Side information is necessary (Theorem 1, Corollary 1.2). Without captured traffic or address/port priors, even verifying that a 5-tuple firewall is deny-all needs 2¹⁰⁴ − 1 probes. Any probing method that terminates in feasible time is therefore either consuming such information or restricting the policy class, whether or not it says so.

(3) What a witness and a hit counter buy (Theorems 2a–2b). One packet per rule plus identity feedback makes reconstruction cost O(n·Σ log W_j) for disjoint lists and (m − 1)(log W + d) + 2m for a tree with m leaves — the latter with d entering additively rather than multiplying the logarithm. The governing quantity is m*(f), the size of the policy's minimal tree, not the number of rules it was written with.

(4) Audit certificates (Theorem 3). Against structural misconfigurations (a mistyped range, an inverted action) a fixed suite of 3m − 2 packets is complete and within a constant of optimal; it needs no traffic capture and can be replayed at every change window.

(5) Partial traffic (Theorem 6). From N sampled packets the expected traffic-weighted error is at most m/(eN); certification needs no traffic at all.

(6) Two open gaps, quantified (Theorems 2a″, 4). Overlapping lists are reconstructible in polynomial time for fixed d, and an action-only observer pays at most O(m^d log W); whether either exponent is necessary is open, and Section 9.7 shows that the first gap is the one that matters on production policies.

(7) Validation. 230 exact simulated reconstructions, a namespace testbed with a real iptables firewall, and 16 production chains (up to 3,570 rules) — all deterministic and reproduced bit-for-bit on two machines.

Semantic invisibility (Lemma 1). Any two policies with the same semantics produce identical transcripts under action-only queries, and a shadowed rule never appears in any answer of any oracle. Consequently shadowing is undetectable by every black-box observer, and redundancy, rule order and rule count by every action-only observer, with any number of probes. Anomaly detection [14,15] is therefore white-box by necessity, not by convention, and black-box audit can only ever mean semantic audit.

Needle in the haystack (Theorem 1). With no side information, exact reconstruction — and even verification that the firewall is deny-all — requires |H| − 1 probes in the worst case, already for single-rule policies, under MQ, IDQ or both, deterministically or randomly, for Tree-Rule as much as for listed rules. For the 5-tuple this is 2¹⁰⁴ − 1. The proof is the standard adversary construction and we do not claim it as a technical contribution. Its value is Corollary 1.2: every practical probing method that terminates on the 5-tuple is consuming external information — captured traffic, alignment to CIDR blocks, port priors — even when the published method does not state it as an oracle assumption, and Theorems 2–4 make explicit what that information buys.

The price of a witness (Theorems 2a, 2a″, 2b). Given one witness per rule and identity feedback, our ProbeByPriority algorithm reconstructs a disjoint listed-rule policy of n rules with 2n·Σ_j⌈log W_j⌉ + n probes (≈ 209n on the 5-tuple), against an Ω(n·d·log(W/n)/log n) information-theoretic lower bound. Overlapping lists can also be reconstructed exactly (Theorem 2a″), but our algorithm costs O(d²n²(2n+1)^d log W) — polynomial only for fixed d — and its tightness is left for future work. A Tree-Rule policy with m leaves needs only (m − 1)(⌈log W⌉ + d) + 2m probes, so d enters additively instead of multiplying the logarithm: a breakpoint in a tree is shared by all leaves beneath its node, so a tree pays once per breakpoint where a list pays once per box side. On identical semantics with n = m the listed representation therefore costs Θ(d) times more (≈ 13 on the 5-tuple, ≈ d + 1 on equal-width fields). The quantity that governs black-box cost is thus m*(f), the size of the minimal tree, and the comparison with the rule list cuts both ways: when m*(f) is close to the number of effective rules the tree is 13–26× cheaper to audit, but when the policy is a cross product of independent constraints m*(f) can exceed the rule count by up to 83× and the list is the more succinct object (Section 9.7). Which representation is cheaper is a property of the policy, not of the syntax, and we measure it on production data.

Audit certificates (Theorem 3). Verification against arbitrary deviations is as hard as reconstruction. Against the realistic class of structural deviations — a boundary typed wrongly, an action flipped, tree shape unchanged — a fixed set of 3m − 2 packets is a complete certificate for a reduced specification — complete for the stated structural-deviation class, not for arbitrary configuration errors — and no set smaller than max(m, 2(m − 1)/d) is. Certification against that class is thus Θ(log W) times cheaper than reconstruction, and the certificate is a concrete deliverable an administrator can hand to an external auditor.

The auditor–attacker gap (Theorem 4). An observer who sees only allow/deny can still reconstruct a Tree-Rule policy with witnesses, but our best bound is O(m^d log W) against an Ω̃(m log W) lower bound. Whether identity feedback is essential to the near-linear bound is left for future work; we show that the natural grouping test provably fails.

1.3. Practical Implications

The results translate into concrete guidance for the people who audit, operate and attack firewalls. (i) For compliance auditors: a black-box audit is meaningful only relative to a declared fault class; for the common class of structural faults (a mistyped range, an inverted action) Theorem 3 gives a fixed regression suite of 3m − 2 packets that can be replayed at every change window, needs no traffic capture and no privileged access, and detected all injected faults on a real iptables firewall in Section 9.11. (ii) For operators deciding what to expose: hit counters and flow logs are an identity oracle, and with them reconstruction costs O(m(log W + d)) (Theorem 2b), whereas our best bound without them is O(m^d log W) (Theorem 4) and whether the gap is real is open (Section 10.2); the same visibility that makes auditing cheap makes reverse engineering cheap, so counters should be exposed to auditors and withheld from untrusted tenants, and traffic confidentiality in front of the firewall (Theorem 1) is the only defense against a party who lacks them. (iii) For designers of policies and cloud filtering products: shadowed rules are invisible to any external observer (Lemma 1), so black-box products cannot find them and configuration hygiene must stay white-box; and the black-box cost of a policy is governed by the size of its minimal Tree-Rule relative to its rule list, so the black-box cost of a policy is a property of its semantics — the size m*(f) of its minimal Tree-Rule — not of how it was written: a policy whose canonical tree is small is cheap to certify regardless of syntax, whereas a cross-product policy inflates m*(f) by up to two orders of magnitude and is, for a black-box auditor, expensive in any representation (Section 9.7). (iv) For penetration testers and red teams: the probe budget of a reconstruction is predictable — about 17–19 real packets per leaf with hit-counter access (Section 9.11) and 2¹⁰⁴ without any side information — which makes it possible to plan, or to detect, a reconnaissance campaign. (v) For vendors of managed or opaque firewalls (cloud security groups, appliances whose rules a tenant cannot read): Theorem 6 quantifies what a tenant can learn about the enforced policy from its own traffic alone, given the identity feedback that flow logs provide. Finally, for the theory community, firewall verification is a natural, structured instance of exact learning of unions of boxes in which the fixed dimension d = 5 keeps listed rules polynomial while unbounded d recovers the barrier of learning disjunctive normal forms (DNF).

1.4. Organization

Section 2 reviews related work; Section 3 fixes the model and oracles; Section 4 proves invisibility and the needle theorem; Section 5 treats witnesses and reconstruction for lists and trees; Section 6 audit certificates; Section 7 the action-only model and the auditor–attacker gap; Section 8 partial witnesses; Section 9 experiments including the real-world case study; Section 10 limitations and future work; Appendix A gives pseudocode, invariants and boundary cases for all algorithms.

2. Related Work

Firewall policy reconstruction and fingerprinting by probing. Samak, El-Atawy and Al-Shaer [2] showed how an attacker reconstructs a policy from probe responses by region growing and split-and-merge, and FireCracker [3] added adaptive smart probing that recovers a semantically equivalent policy without prior knowledge; El-Atawy et al. [16] studied adaptive early packet filtering, and Khakpour et al. [4] and Liu et al. [5] fingerprint firewall implementations from decisions on unusual TCP flags and from packet-processing time, also introducing denial-of-firewalling attacks. In software-defined networks, Bifulco et al. [17] fingerprint controller–switch interactions and infer installed flow rules by probing. All are algorithms with empirical evaluation; none states a lower bound, an optimality claim, or a formal account of the side information on which termination depends. Theorem 1 shows that such side information is mathematically necessary and Theorems 2–4 quantify what it buys.

Firewall analysis, anomaly detection and design. Hazelhurst [18], Mayer, Wool and Ziskind (Fang) [19], Bartal et al. (Firmato) [20] and Wool (Lumeta) [21] pioneered rule-set analysis; Al-Shaer and Hamed [14,22] classified shadowing, redundancy, correlation and generalization and extended the taxonomy to distributed firewalls; Yuan et al. built FIREMAN on binary decision diagrams [15]; Gouda and Liu introduced firewall decision diagrams and structured firewall design [23,24], later showing that verification and redundancy checking are inter-reducible [25] and giving linear-time property verification [26]; TCAM Razor and related work minimize classifiers through decision diagrams [27]; Abbes, Bouhoula and Rusinowitch built an inference system over a tree representation of the rules [28]; Diekmann et al. verified iptables semantics in Isabelle/HOL and published the real rule sets used in Section 9.7 [29,30]; recent surveys and frameworks continue this line [31,32]. Our own Tree-Rule firewall [11,12,13,33,34] replaces the ordered list by a decision tree over fixed fields, eliminating shadowing and speeding matching, our early relational-algebra analysis of firewall policies [35,36] and our recent algebra for two-layer cloud filtering [37] belong to the same white-box tradition. All of this work is white-box: it consumes the rule text. Lemma 1 explains why it must be. The canonical Tree-Rule used in Section 9.7 is an FDD-style tree with a fixed field order, and the worst-case FDD size that follows from the construction of Gouda and Liu [23,24] — n rules contribute at most 2n endpoints per field, hence at most 2n + 1 intervals per node and at most (2n + 1)^d leaves — is the theoretical root of the cross-product blow-up observed there.

Firewall conformance testing and network verification. Jürjens and Wimmel [38] and Senn et al. [39] pioneered specification-based firewall testing; Brucker, Brügger and Wolff [40,41] derive test cases from a HOL model with verified test-set optimization; Hwang, Xie, Chen and Liu [42,43] proposed structural coverage criteria and fault models for firewall policies; Al-Shaer, El-Atawy and Samak [44] automated conformance testing with symbolic packet spaces. On the network side, Anteater [45], Header Space Analysis [6], ATPG [7], VeriFlow [46], NetPlumber and NetKAT [47,48] verify or test data planes and generate minimal test suites over equivalence classes. These works generate suites for coverage but do not prove completeness for a formally defined fault class, nor state lower bounds; Theorem 3 does both, and Theorem 1(c) shows that completeness against unrestricted faults is impossible.

Exact learning with queries. Angluin [10] introduced membership and equivalence queries; Bshouty [49,50] and Kushilevitz and Mansour [51] gave decision-tree learning from membership (and equivalence) queries and Fourier methods; Beimel and Kushilevitz [52,53] and Bshouty et al. [54] learn unions of boxes over discrete and real domains, and unions of hypercubes over Z^d are learnable in polynomial time for fixed d while generalizing DNF for unbounded d [55]; Goldman and Kearns' teaching dimension [56], the general query lower bounds of Hegedűs [57] and Auer–Long [58], and Yao's minimax principle [59] supply our lower-bound tools; property testing [60] motivates the verification/learning distinction. None of this literature mentions firewalls, packets or rule priority in the exact-learning sense; the next paragraph states precisely what the translation adds.

Relation to learning unions of boxes. Theorems 2a and 2a″ are not instances of [52,53,54,55], and the difference is structural rather than cosmetic. Those results learn a union of boxes as a set — a single Boolean function — from membership and equivalence queries; no identifier is attached to a box, no point of each box is promised, and equivalence queries are essential to their termination. Our setting differs in three ways that change both algorithm and bounds. (i) First-match priority makes the target a labeled partition into effective regions E_i = B_i \ ∪_{k<i} B_k, not a union; the object learned is the list, and the argument of Theorem 2a″ that hull(E_i) suffices in place of B_i has no analogue in set learning. (ii) The identity oracle returns the index of the matching rule; it replaces the equivalence oracle, and for disjoint lists it decouples the rules entirely, yielding a bound linear in n·Σ_j log W_j with no dependence on the arrangement of the boxes, whereas the corresponding set-learning bounds are polynomial in n only for fixed d. (iii) Witnesses are exactly the side information that Theorem 1 proves necessary; in [52,53,54,55] that role is played by counterexamples from the equivalence oracle, which a black-box auditor does not have. Theorem 2b has no counterpart in that literature: it concerns a fixed-order decision-tree class over integer intervals, and the disappearance of d from its bound is a property of breakpoint sharing in the tree, not of boxes. Proposition 5 marks where the two lines meet: unbounded d with unbounded overlap recovers DNF.

3. Model

3.1. Header Space and Policies

Field j has domain [W_j] = {0,…,W_j − 1}, W_j = 2^{w_j}; H = [W_1]×…×[W_d]. For the IPv4 5-tuple (32,32,16,16,8), |H| = 2¹⁰⁴. Throughout, log W denotes ⌈log₂ max_j W_j⌉, the width of the widest field (32 for the 5-tuple), and Σ_j log W_j = Σ_j w_j the total header width (104). A box is a product of integer intervals. A policy is a function f : H → {0,1} (deny/allow). A listed-rule policy P = ⟨(B_1,a_1),…,(B_n,a_n); a_0⟩ has first-match semantics; the effective region of rule i is E_i = B_i \ ∪_{k<i} B_k, and ∪_{k≤i}E_k = ∪_{k≤i}B_k. A Tree-Rule policy T is a rooted tree in which the node at depth j tests field j and splits [W_j] into k contiguous intervals by k − 1 breakpoints; leaves carry actions. Every leaf is a box, the leaves partition H, and along any axis-parallel line in field j the value of f can change only at breakpoints of the unique node testing field j on that path. We write m(T) for the number of leaves and β(T) for the total number of breakpoints; since m = 1 + Σ_v (k_v − 1) over internal nodes, β(T) = m − 1 for every tree, so we use m alone. The minimal tree T*(f) is one of minimum m; m*(f) is a semantic invariant of f. We write LR_n for the class of listed-rule policies with at most n rules, LR_n^{disj} for its subclass in which the boxes are pairwise disjoint, and TR_m for the class of Tree-Rule policies with at most m leaves.

3.2. Oracles, Side Information, and Tasks

MQ(h) returns f(h). IDQ(h) returns the index of the first matching rule (LR) or the leaf identifier (TR); it models an auditor with access to hit counters (iptables -v, Cisco ACL hit counts, NSG flow logs). We also refer once (Proposition 5) to Angluin's equivalence query EQ, which takes a hypothesis and returns a counterexample or ‘equal’; it is used only to place our classes in the learning-theory landscape. A witness set $𝒲$ supplies one packet h_i ∈ E_i per non-shadowed rule (LR) or one packet per leaf (TR). LEARN(C, O) asks for g ≡ f from oracle set O, for f in class C; Q_det and Q_rand denote worst-case deterministic and randomized (error ≤ 1/3) query complexity. VERIFY(C, O; g) asks whether f ≡ g. AUDIT-CERT(C; g) is the smallest S ⊆ H such that for all f ∈ C, f|_S = g|_S implies f ≡ g.

Table 1 summarizes the tasks studied and what each can and cannot reveal; the distinction between learning the semantics f and learning a representation of f recurs throughout.

4. Invisibility and the Needle Theorem

Lemma 1 (Semantic invisibility).   (a) If f_P ≡ f_{P'} then no algorithm using MQ (any number of queries, deterministic or randomized) distinguishes P from P'. In particular redundancy, shadowing, rule count and rule order are undetectable under MQ, and every action-only black-box-measurable quantity is a function of f alone. (b) A shadowed rule (E_i =∅) never appears in any answer of MQ, IDQ or MQ+IDQ; hence its existence is undetectable by every black-box observer, with any number of probes.

Proof. (a) The transcript of any algorithm depends only on the answers f(h), which coincide for P and P'. (b) IDQ(h) returns the index of the first rule whose box contains h, i.e. the unique i with h ∈ E_i; a rule with E_i = ∅ is therefore never returned, MQ carries no index at all, and neither oracle can be asked to enumerate indices. ∎

Remark (identity queries, complementing Lemma 1(b)). IDQ reveals more than f: two representations with the same semantics but different effective-region partitions {E_i} give different transcripts, so redundancy and rule order become partly visible — this is exactly how administrators find unused rules from hit counters. What stays invisible under IDQ is any shadowed rule: it never appears in an answer and the oracle cannot be asked to enumerate identifiers, so its existence is undecidable. The IDQ-observable object is the labeled partition of H into effective regions with their actions.

The following bound is elementary — it is the adversary argument of [57,58] specialized to single cells — and we record it because its corollary, not its proof, is what the probing literature has left implicit.

Theorem 1 (Needle in the haystack).   Let C_1 be the class of single-box policies together with deny-all; C_1 is contained in LR_n (n ≥ 1) and TR_m (m ≥ 2d + 1). For O∈{MQ, IDQ, MQ+IDQ} without witnesses: (a) Q_det(LEARN(C_1,O)) ≥ |H| − 1; (b) Q_rand(LEARN(C_1,O)) ≥ (|H| − 1)/3; (c) Q_det(VERIFY(C_1,O; g ≡ 0)) ≥ |H| − 1, and more generally, for any specification g and the class C_g of policies that differ from g on at most one cell, Q_det(VERIFY(C_g,O; g)) ≥ |H| − 1; (d) the same holds for TR.

Proof. (a) The adversary answers deny/default to every query. After q < |H| − 1 queries two unqueried cells h ≠ h' remain; the single-cell policies f_{{h}}, f_{{h'}} and deny-all are all consistent with the transcript, so the algorithm errs on at least one. (b) By Yao's principle take the uniform distribution over {deny-all} ∪ {f_{{h}} : h ∈ H}; a deterministic algorithm with q queries identifies f_{{h}} only if it queried h, giving error ≥ (|H| − 1 − q)/(2|H|), which exceeds 1/3 unless q ≥ (|H| − 1)/3 up to rounding. (c) Deciding f ≡ 0 requires ruling out every f_{{h}}; for general g the adversary answers g(h) (and g's identifier) to every query, so after q < |H| − 1 queries two unqueried cells remain and g, g with the first cell flipped, and g with the second cell flipped are all consistent with the transcript. (d) C_1 ⊆ TR_m for m ≥ 2d + 1: deny-all is a one-leaf tree, and a single cell is a fixed-order tree with at most 2d + 1 leaves (three intervals per field). ∎

Corollary 1.1. On the 5-tuple, ≥ 2¹⁰⁴ − 1 probes; at 10⁹ probes per second this is ≈ 6·10¹⁴ years. Corollary 1.2. Any probing method that terminates in feasible time on the 5-tuple must be using side information (captured traffic, CIDR alignment, port priors) or a restricted policy class; this is a mathematical requirement, not an engineering detail, even when the published method does not state it as an oracle assumption.

5. The Price of a Witness

5.1. Listed Rules with Identity Feedback

Let the overlap depth ω(P) be the maximum number of rule boxes containing a common packet. Rules are pairwise disjoint iff ω(P) = 1; then E_i = B_i for every i.

Theorem 2a (upper bound, disjoint rules).   Q_det(LEARN(LR_n^{disj}, IDQ+   $𝒲$   )) ≤ 2n·Σ_j   ⌈   log W_j   ⌉+ n. On the 5-tuple this is 209n.

Proof. Algorithm ProbeByPriority (Algorithm A1): for each rule i with witness h_i and each field j, the set {t : IDQ(h_i[j←t]) = i} equals the interval I_i^j of B_i on that line, because IDQ = i exactly on E_i = B_i (other boxes crossing the line answer with their own index or the default). Its two endpoints are found by binary search from h_i^j using ⌈log W_j⌉ queries each; the action costs one MQ. The recovered box equals B_i, so f is reproduced exactly. ∎

Theorem 2a′ (lower bound).   Q_det(LEARN(LR_n^{disj}, IDQ+   $𝒲$   )) ≥ 2nd·log(W/(2n)) / log(n+1). Under MQ+   $𝒲$with well-separated allow-boxes on a deny background the bound is 2nd·log(W/(2n)) − O(1).

Proof. Place n boxes in disjoint slabs of field 1 so that disjointness holds for every choice of endpoints; give each of the 2nd endpoints an uncertainty interval of length W/(2n) that does not contain the witness. All (W/(2n))^{2nd} configurations are semantically distinct and consistent with the witnesses. Each IDQ answer is one of n+1 symbols, hence carries ≤ log(n+1) bits; identification needs ≥ 2nd·log(W/(2n)) bits. Under MQ answers are binary, so the same (W/(2n))^{2nd} configurations require ≥ 2nd·log(W/(2n)) queries directly; well-separated boxes are needed here so that every configuration in the product remains a valid pairwise-disjoint policy (adjacent boxes could merge under some endpoint choices, reducing the configuration count). ∎

Theorem 2a″ (overlapping rules).   For an arbitrary first-match list of n rules (any overlap), Q_det(LEARN(LR_n, IDQ+   $𝒲$   )) ≤ O(d²·n²·(2n+1)^d·log W); in particular the task is polynomial for fixed d. Rules whose box is unoccluded by higher-priority boxes on all 2d sides of the witness line cost only the Theorem 2a amount.

Why the disjoint algorithm fails. On the witness line the endpoint of I_i^j may be hidden inside a higher-priority box while B_i extends further elsewhere: with B_1 = [5,10]×[0,10], B_2 = [0,8]×[0,20] and h_2 = (2,3), the search along field 1 stops at 4, yet (6,15) ∈ E_2. Worse, E_2 may have points that differ from every known point of E_2 in two or more coordinates (a ‘corner’ behind an occluding box), which no single-axis search from a known point can reach.

Proof sketch (full proof inAppendix A.5). Rules are processed in priority order, so when rule i is reached the union U of the higher-priority boxes is known exactly. Two facts make the problem tractable. First, it suffices to recover hull(E_i) rather than B_i, because E_i ⊆ hull(E_i) ⊆ B_i and the higher-priority union is the same in both cases, so the reconstructed list has the same semantics. Second, outside U the identity oracle is a membership oracle for B_i: for q ∉ U, IDQ(q) = i iff q ∈ B_i. The endpoints of the boxes in U cut each field into at most 2i − 1 intervals; the resulting grid of (d − 1)-cells and axis-parallel ‘testable’ intervals (those disjoint from U) has at most (2n+1)^d elements. Algorithm CellSweep grows the hull H of the packets known to lie in E_i by probing, for every axis, every grid cell and every testable interval, the point of that interval nearest to H, and extending H by binary search whenever the oracle answers i. A nearest-corner argument shows that any p ∈ E_i not yet covered forces at least one such probe to answer i, so at a fixpoint H = hull(E_i). Each of the 2d endpoints of H moves monotonically and only to a true endpoint of B_i or to a grid coordinate, giving O(n) rounds of O(d·(2n+1)^d·log W) queries per rule. When the witness line is unoccluded on all 2d sides, Phase 1 alone returns B_i at the Theorem 2a cost and the sweep is skipped. ∎

Reading. Theorem 2a″ closes the correctness question for overlapping lists but not the cost question: the (2n+1)^d factor comes from sweeping every cell of the arrangement of higher-priority boxes, and Section 9.10 shows that it matters in practice (up to 3.5·10⁵ probes for 12 four-field rules) while unoccluded rules stay at the Theorem 2a cost. Whether reconstruction of overlapping lists is possible in poly(n, d, ω)·log W — ω the overlap depth — is left for future work (Section 10.2); the (2n + 1)^d worst-case size of firewall decision diagrams (Section 2) suggests that some dependence on the arrangement may be unavoidable.

5.2. Tree-Rule with Identity Feedback: The Dimension Leaves the Logarithmic Term

Theorem 2b.   Q_det(LEARN(TR_m, IDQ+   $𝒲$   )) ≤ (m − 1)(   ⌈   log W   ⌉+ d) + 2m, and Q_det ≥ (m − 1)·log(W/m)/log(m+1).

Proof. Upper bound, top-down (Algorithm A2 in Appendix A gives pseudocode, invariants and the boundary cases). Query the leaf identifier of every witness (m queries). At a node v testing field j with witnesses sorted by field j, two consecutive witnesses w, w' lie in the same child iff IDQ(w[j←w'^j]) = IDQ(w): under v no node tests field j again and all other coordinates are held at w, so the leaf is constant inside a child and changes across a breakpoint (one query per consecutive pair; a witness is re-tested at every level below the node it lies in, so the pair tests at depth j number m − N_j, with N_j the number of nodes at that depth, and at most d(m − 1) over the d levels — a node with a single child still pays its pair tests while contributing no breakpoint). Between different children the breakpoint is found by binary search on t ∈ (w^j, w'^j] with predicate IDQ(w[j←t]) = IDQ(w), which is monotone on that interval (⌈log W⌉ queries per breakpoint). Recurse into each child with its witnesses; each leaf's action costs one MQ. Total: m + d(m − 1) + (m − 1)⌈log W⌉ + m = (m − 1)(⌈log W⌉ + d) + 2m. Lower bound: a depth-one tree on one field with m − 1 breakpoints in general position already realizes (W/m)^{m−1} semantically distinct policies consistent with the witnesses; IDQ answers carry ≤ log(m+1) bits. ∎

Discussion. The number of header fields enters the tree bound additively rather than multiplying the logarithm. A listed rule pays 2d binary searches per box, because every box owns its 2d sides, so d multiplies the logarithmic term; a tree pays one binary search per breakpoint — and a breakpoint is shared by every leaf below the node — so its only cost in d is the single pair test each witness pays at each level, one query rather than ⌈log W⌉ of them. On identical semantics the ratio of listed to tree probes is therefore Θ(d) — measured 12.6–12.9 on the 5-tuple for n ≥ 300, and growing linearly from 3.3 (d = 2) to 13.1 (d = 12) on 8-bit fields, i.e., ≈ d + 1 (Section 9.3). This is the mathematical content of the claim that Tree-Rule policies are cheaper to audit — for the same semantics and the same number of items; when the minimal tree has many more leaves than the effective rule list, the comparison reverses (Section 9.7).

6. Audit Certificates

By Theorem 1(c), certifying f ≡ g against arbitrary deviations costs |H| − 1 probes, and witnesses for the leaves of g do not help, since a deviation may be a single cell that no such witness touches. Black-box audit is therefore meaningful only relative to a fault class. We consider the class of structural deviations Dev(g): policies whose tree has the same shape as g (same nodes and children) but with any breakpoints moved, any leaf actions flipped, or both — the misconfigurations produced by mistyped ranges and inverted actions.

Theorem 3 (Θ(m) audit certificate).   Let g be a reduced Tree-Rule with m leaves — reduced meaning that no two adjacent siblings are semantically equal, which any tree can be made by merging (Section 9.4does so). Then g has m − 1 breakpoints, all semantically active. (a) There is a fixed, non-adaptive S with |S| ≤ 3m − 2 such that for every f∈Dev(g), f|_S = g|_S implies f ≡ g. (b) Every such S has |S| ≥ max(m, 2(m − 1)/d). (c) Consequently AUDIT-CERT = Θ(m), whereas LEARN(TR_m,·+$𝒲$) ≥ Ω̃(m log W): certification is cheaper than reconstruction by Θ(log W).

Proof. (a) Put one interior point of every leaf into S. For each breakpoint b of a node v (field j) between children c, c′, reducedness gives a suffix y with g_c(y) ≠ g_{c′}(y); put (π, b − 1, y) and (π, b, y) into S, where π is any prefix in v's region. Let f ∈ Dev(g) agree with g on S; we show f ≡ g by induction from the root. Suppose the breakpoints of all ancestors of v coincide with g's, so v's region is the same in f and g. The k − 1 straddling pairs of v occupy the pairwise disjoint intervals (b_s − 1, b_s]; if some pair were not separated by a breakpoint of f, both of its points would lie in one child of v under f and — since under v field j is not tested again — f would take the same value on both, whereas g takes different values there; so each pair is separated by a breakpoint of f, and since f has exactly k − 1 breakpoints at v they are exactly g's. Hence all breakpoints of f coincide with g's, every leaf region is identical, and the interior points force every action to coincide. (Without reducedness the claim fails: an inert breakpoint may move so far that a flipped leaf escapes its interior point.) (b) If some leaf has no point of S, flip its action: the result is in Dev(g), differs from g, and agrees on S; so |S| ≥ m. Moving b to b + 1 (resp. b − 1) changes f only on the layer p_j = b (resp. b − 1) inside v's region at distinguishing suffixes; detecting both directions requires a point on each layer. A single point lies on at most one layer per field, and nodes testing the same field have disjoint regions, so each point serves at most d breakpoint layers; hence |S| ≥ 2(m − 1)/d. (c) follows by comparing (a) with the lower bound of Theorem 2b. ∎

Corollary 3.1. A 200-leaf reduced Tree-Rule admits a certificate of 598 packets, versus ≈ 3,000 observed (≤ 7,763 bound) probes for reconstruction (Theorem 2b) and 2¹⁰⁴ without a promise (Theorem 1(c)). The certificate is a static artifact that can be replayed at every change window.

7. The Action-Only Observer and the Auditor–Attacker Gap

Theorem 4.

Q_det(LEARN(TR_m, MQ+   $𝒲$)) ≤ O(m^d·log W); in particular the task is polynomial for fixed d. The lower bound Ω((m − 1)·log(W/m)) holds even for MQ.

Proof. Slice recursion learn(π, j, $𝒲$_π): if j = d return a leaf with action MQ(π). Otherwise let v_1 < … < v_r be the distinct field-j values among $𝒲$_π; for each v_s learn the sub-slice g_s = learn((π,v_s), j+1, $𝒲$ projected onto fields ≤ j := (π,v_s)) — correct because the witness of every leaf under the child containing v_s remains in its leaf after projection, since ancestors do not test fields > j and field j := v_s stays in the child's interval. Merge consecutive equal g_s; between g_s ≠ g_{s+1} compute (offline) a suffix y on which they differ and binary-search field j on the line (π,·,y): f changes there exactly at the breakpoint. Query count T_j ≤ r·T_{j+1} + r⌈log W⌉ with r ≤ m gives O(m^d log W). The lower bound is that of Theorem 2b with binary answers. ∎

Why the natural shortcut fails. One would like to decide whether two slices belong to the same child by comparing f on the projected witness points only. This is unsound: for children c: [0,10)→1, [10,20)→0 and c′: [0,5)→1, [5,20)→0 with witness suffixes {2,15} and {2,12}, both children agree on all four points yet differ on [5,10). Hence sub-slices must be learned in full before comparison, and the exponent d appears. Whether Q(LEARN(TR_m, MQ+$𝒲$)) = Õ(m(log W + d)), i.e., whether identity feedback is inessential, is the auditor–attacker gap discussed in Section 10.2. Empirically the ratio MQ-only/IDQ reaches 5 (d = 2, m = 43), 53 (d = 3, m = 27) and 427 (d = 4, m = 16), consistent with the m^d growth of the algorithm and with a genuine gap.

Remark (what governs the cost — class-relative reading). By Lemma 1 every action-only black-box cost is a function of f alone, and Theorems 2b–4 bound the cost of any f from above by functions of m*(f)·log W. The lower bounds, however, are stated for the whole class TR_m; a specific f that admits a short listed description (n ≪ m*(f)) belongs to a smaller class whose information content is only O(n·d·log W) bits, so for such f the true cost may lie strictly between the two. Section 9.7 shows that this case is common in practice, which is why the overlapping-list problem of Section 5.1 matters.

Proposition 5 (dimension gap and DNF barrier). For Tree-Rule policies with identity feedback the cost is linear in m and depends on d only additively (Theorem 2b), whereas without identity feedback d moves into the exponent, O(m^d·log W) (Theorem 4); for listed rules with unbounded overlap the class contains all unions of Boolean boxes when d is unbounded, i.e., DNF, so black-box learning of such lists with MQ+EQ is at least as hard as learning DNF with MQ+EQ, a long-standing open problem, while for fixed d polynomial algorithms exist with d in the exponent [52,55]. We state this as a proposition because it is a reduction to known results rather than a new bound. In modern cloud policies d is no longer 5 (labels, tags, identities), and the tree representation is the one whose black-box cost stays linear.

8. Partial Witnesses: When Traffic Does Not Cover Every Leaf

Theorems 2b and 4 assume one witness per leaf. Captured traffic rarely covers every leaf of a real policy, so we ask what a partial witness set buys. The answer is simple: with identity feedback, discovery is free and the guarantee degrades exactly to the probed region; the loss from sampling is bounded by the missing mass of the leaf distribution; and certification needs no witnesses at all.

Theorem 6 (partial witnesses).   Let$𝒲$ ⊆H be an arbitrary set of packets, covering only some leaves of the hidden Tree-Rule f with m leaves. (a) The Theorem 2b learner, modified to adopt as a new witness every probed packet whose identifier has not been seen before (restarting the current node), outputs f̂ that agrees with f on every leaf containing at least one probed packet; the disagreement region is contained in the union of leaves that no probe ever touched. Its cost is O(m̂²·log W) where m̂ ≤ m is the number of leaves discovered (each discovery restarts one node). (b) No algorithm using the same probes can output anything about a leaf that no probe touched (Theorem 1 relativized to that leaf's region). (c) If$𝒲$consists of N packets drawn i.i.d. from a distribution D on H, then E[D(f̂ ≠ f)] ≤ Σ_L p_L(1 − p_L)^N ≤ m/(e·N), where p_L is the D-mass of leaf L; hence N = m/(eε) captured packets give expected D-error at most ε. (d) The audit certificate of Theorem 3 is computed from the specification alone and needs no witnesses.

Proof. (a) Consider a node v testing field j during the top-down pass. If an unwitnessed child c′ lies between witnessed children c and c″, the pair test and the binary search between their witnesses probe points of c′; if a probe lands in c′ its identifier is new and the packet becomes a witness, after which v is processed again with c′ present. If no probe lands in c′, the search returns the boundary c | c′ (the predicate is monotone across c′ ∪ c″ because both differ from c's identifier) and c′'s interval is assigned to c″; f̂ then differs from f only inside c′, and inductively only inside leaves never probed. An unwitnessed child at either end of v is treated identically: its interval is absorbed by the adjacent witnessed child, and only a probe that lands in it (triggering discovery) can change this. Each discovery restarts one node with at most m̂ witnesses, costing O(m̂ log W), and there are at most m̂ discoveries. (b) is Theorem 1 applied to the sub-box of an untouched leaf. (c) By (a) the error region is contained in the union of unwitnessed leaves; the expected D-mass of leaves missed by N samples is the missing mass Σ_L p_L(1 − p_L)^N, and p(1 − p)^N ≤ p·e^{−pN} ≤ 1/(eN) for every p ∈ [0,1], with m terms. (d) The certificate of Theorem 3(a) uses only g. ∎

Reading. Part (c) is a Good–Turing missing-mass statement: the reconstruction from a traffic sample is wrong only on traffic-poor leaves, and its expected traffic-weighted error falls as 1/N with a constant that is the number of leaves. Part (d) separates the two auditing modes: an auditor with a specification certifies without any traffic; an auditor without one must reconstruct and pays for coverage. Section 9.8 measures (a)–(c).

9. Experiments

Experiments E1–E10 are exact simulations: the oracle is implemented from a generated policy, so probe counts are exact and every reconstruction is checked for semantic equivalence against the hidden policy (230 reconstructions — 100 in E2, 40 in E1, 90 in E3 — all equivalent, plus 16 in E7, 45 in E10 and 4 on the real firewall in E11). Code (a1sim.py, run_experiments.py, make_figures.py) is deterministic with fixed seeds; E1–E6 run in ≈ 3 minutes on a laptop and the whole simulation suite in ≈ 10, and all of it reproduced bit-for-bit on two independent machines (Windows 11 / Python 3.12 and Linux / Python 3.12). E11 (Section 9.11) replaces the simulated oracle by a real iptables firewall. In E7 and E11 the 16 production chains are used as sources of realistic policies; the theorems are tested on those policies, not derived from them. Unless stated, the header space is the IPv4 5-tuple (32, 32, 16, 16, 8 bits) and Tree-Rule policies are random trees with the fixed field order and random breakpoints.

9.1. Tree-Rule Reconstruction with Identity Feedback (E2, Theorem 2b)

100 random trees with m from 1 to 3,671 leaves. Observed probes are 13.2–17.4 per leaf for m ≥ 100 (median 15.0), below the bound (m − 1)(⌈log W⌉ + d) + 2m of Theorem 2b (which is ≈ 39 per leaf here, because the bound uses the widest field whereas the trees split 8- and 16-bit fields as often as 32-bit ones, and because each binary search runs between two witnesses rather than over a whole field) and above the information-theoretic lower bound. Growth is linear in m across three orders of magnitude (Figure 1).

9.2. Listed Versus Tree Representation of the Same Policy (E1, Theorems 2a/2b)

Each of 40 random trees (n = m from 2 to 610) is exported as a disjoint listed-rule policy and reconstructed both as a list (Theorem 2a) and as a tree (Theorem 2b) with IDQ + witnesses. Listed reconstruction uses 191–193 probes per rule for n ≥ 100 (up to 197 for the smallest lists) against the bound 209 n; tree reconstruction uses ≈ 15 per leaf for n ≥ 300 (more for small trees, up to 29 at n ≤ 6, where fixed per-tree costs dominate); the ratio converges to 12.6–12.9 for n ≥ 300 (Figure 2).

9.3. Dimension Dependence (E6)

With all fields 8 bits wide and d from 2 to 12 (six random policies each, m ≈ 15–65), the listed cost per rule grows linearly with d (≈ 13d), whereas the tree cost per leaf rises only from 8.3 to 11.9 across the whole range and flattens beyond d = 5: an extra field costs a tree one query per witness per level, against 2⌈log W_j⌉ per side for a list. Every run stays under the bound of Theorem 2b, whose per-leaf value grows from 11.7 at d = 2 to 21.1 at d = 12; the measured cost grows more slowly than the bound allows because each binary search runs on the interval between two witnesses rather than on the whole field. The mean ratio of listed to tree cost is 3.27, 3.97, 4.73, 5.50, 6.62, 8.83, 11.01 and 13.13 for d = 2, 3, 4, 5, 6, 8, 10, 12 — almost exactly d + 1, the empirical face of the different roles d plays in the two bounds (Figure 3).

9.4. Audit Certificates (E4, Theorem 3)

For seven random trees, reduced by merging equal adjacent siblings (m from 4 to 450 after reduction), the certificate of Theorem 3(a) has 3m − 2 packets before de-duplication (at most two coincide). Against 1,389 single injected structural deviations (a random leaf-action flip or a random breakpoint move by up to 1,000 units) and 1,400 combined deviations (a move and a flip together) that changed the semantics, the certificate detected 1,389 and 1,400, respectively (100%). Random subsets keeping 70% of the packets missed 12–18% of single deviations, consistent with the lower bound that every leaf and every breakpoint must be touched (Figure 4).

9.5. Action-Only Observer (E3, Theorem 4)

On 2-, 3- and 4-field policies (8-bit fields; 90 policies) the slice-recursion learner with MQ + witnesses always reconstructs the policy exactly, but its cost relative to the IDQ learner grows steeply: at most 5× for d = 2 (m = 43), 53× for d = 3 (m = 27) and 427× for d = 4 (m = 16), matching the m^d behavior of Theorem 4 (Figure 5).

9.6. Needle in the Haystack (E5, Theorem 1)

Five hidden single-box policies of realistic size (a /24 source, one destination host, any source port, one destination port, TCP — 2²⁴ of the 2¹⁰⁴ headers, so an expected 2⁸⁰ random probes) received 10⁸ uniformly random probes each (5 × 10⁸ in total); none was hit, consistent with the 2⁸⁰ expectation and with Theorem 1.

9.7. Case Study: Real-World Iptables Rulesets (E7)

We applied the framework to the largest public collection of real iptables rulesets we are aware of, published by Diekmann et al. with their verified analysis toolchain [29,30] (redistributed under the authors' licences; see Data Availability Statement): 16 filter chains from production firewalls — a university network (TUM, up to 3,570 rules), a medium-sized company, a home router, Docker hosts, UGent, Synology, a Shorewall deployment and two small servers (sargon, gopherproxy). Each chain was taken in Diekmann's simple-firewall normal form (5-tuple with CIDR and port ranges) and interpreted with first-match semantics; a canonical Tree-Rule was built for every field order (all 120 for n ≤ 300, eight heuristic orders otherwise) and the smallest kept. Every tree was checked to be semantically identical to its rule list, then reconstructed with the Theorem 2b learner (all reconstructions equivalent) and its Theorem 3 certificate computed. Table 2 lists the semantically non-trivial chains; the run reproduces bit-for-bit on the two test machines. Two caveats govern the reading of Table 2. First, the column "listed bound" is the Theorem 2a bound 2n·Σ⌈log W_j⌉ + n, which is proven only for pairwise-disjoint lists; the real lists overlap, so for them the column is a benchmark (the cost the list would have if it were disjoint), not a proven upper bound — reconstructing overlapping lists is possible (Theorem 2a″) but at a cost that is polynomial only for fixed d, and its tightness is left for future work (Section 10.2). Second, the trees are canonical fixed-order trees built FDD-style [23]: at each node the field is cut at every rule endpoint active in the current region, and adjacent children with equal subtrees are merged; all 5! = 120 field orders were tried when n ≤ 300 and eight heuristic orders otherwise, so m* is an upper bound on the true minimum only in the latter case. The choice of field order matters: on the UGent chain the eight heuristic orders give at best 24,218 leaves whereas the best of the 120 orders gives 4,865 (a 5.0× difference), and the best order differs from chain to chain (Table 2 reports the best found). The case study illustrates the theorems on production data; it does not prove them.

Three observations. (i) Invisibility in the wild: the Shorewall chain has 1,918 rules of which 1,849 are shadowed, and the TUM lower approximation collapses 1,614 rules to a single deny-all leaf; by Lemma 1(a) no action-only observer, with any budget, could tell these chains from a one-rule policy, and by Lemma 1(b) no observer at all could detect the shadowed rules. (ii) The bounds are respected at production scale: the 3,570-rule TUM chain becomes a 20,128-leaf tree and is reconstructed exactly with 513,612 probes (25.5 per leaf), below the listed bound of 746,130; typical host and container policies (docker, home, Synology) have m* ≤ 2.1 n_eff and are 13–26× cheaper to audit as trees, with certificates of a few hundred packets. (iii) A dichotomy: chains built from independent source-port and destination-port constraints on wide address ranges (UGent, gopherproxy, the company chain) are cross products, and their minimal Tree-Rule has 18–83 leaves per effective rule; there the tree learner needs 2–11× more probes than the disjoint-list benchmark, and the certificate grows to 10⁴ packets (Figure 6). Since for an action-only observer Lemma 1 makes the cost a function of the semantics only, the correct reading is that for cross-product policies the identity oracle over the original overlapping list carries strictly more structure than the tree exposes — precisely the overlapping-list question of Section 5.1, which the case study elevates from a technicality to the central direction for future work in black-box firewall audit.

9.8. Partial Witnesses from Sampled Traffic (E8, Theorem 6)

For nine trees with m from 31 to 449 leaves, witnesses were replaced by N uniformly random packets (a traffic sample under the uniform distribution) with N from m/4 to 16m, and the discovery-augmented learner of Theorem 6(a) was run. With N = m the sample covers only 22–45% of the leaves (≈ 30% for the three largest trees), discovery raises this to 25–55% (≈ 41–42% for the largest), and the uniform-measure error of the reconstruction is 4.0–5.3% for the three largest trees (m ≈ 410–449) and 4.0–9.5% across all nine, against the bound m/(eN) = 37%; with N = 16m the error is 0.14–0.23% for the largest trees and 0.14–0.64% across all nine, against 2.3%. The error is always below the bound and always confined to undiscovered leaves, as (a) and (c) state (Figure 7).

9.9. Sensitivity: Wrong Witnesses, Noisy Identity Feedback, Non-Reduced Specifications (E9)

Three departures from the exact model were tested (e9_sensitivity.py; all runs deterministic). (a) Wrong witnesses: replacing 10%, 30% or 50% of the witnesses of a 70–261-leaf tree by uniformly random packets — which are still packets of some leaf, so Theorem 6 applies — leaves the volume-weighted error of the discovery-augmented learner at 0.0–1.0%, 0.4–6.0% and 1.1–3.8%, respectively, with essentially unchanged probe counts; wrong witnesses are absorbed as witnesses of the leaf they actually fall in. (b) Noisy identity feedback: if each IDQ answer is replaced by a random identifier with probability p (the learner being unaware), the exact learner of Theorem 2b degrades quickly — error 0.2% at p = 0.001, 9.5% at p = 0.01 and 30% at p = 0.05 on an 86-leaf tree — because a single wrong answer inside a binary search misplaces a breakpoint; the exact-oracle assumption is therefore essential, and repeated queries with majority vote (which multiply the cost by O(log m)) are the natural remedy for real hit counters, left for future work. (c) Reducedness in Theorem 3: for four random trees, the certificate built from the non-reduced tree missed 1 of 200 combined move-and-flip faults in two of four cases (exactly the failure mode described after Theorem 3), whereas the certificate of the reduced tree detected 200 of 200 in all four; reduction also shrinks the certificate (e.g., 68 → 55 and 122 → 106 packets). Together with the field-order sensitivity of Section 9.7 (m* varies by up to 5× across orders on the same chain) and the incomplete-witness study of Section 9.8, these runs delimit where the exact model can be trusted.

9.10. Overlapping Listed Rules (E10, Theorem 2a″)

Random overlapping boxes (side up to 60% of each field) with n = 2…12 rules on 2, 3 and 4 fields (all fields 8 bits wide for d = 2 and d = 3, 6 bits wide for d = 4; 45 lists); CellSweep reconstructed every list exactly (verified exhaustively for d = 2, by 6,000 samples plus rule corners otherwise). Unoccluded lists (all sides visible on the witness lines, e.g., n = 2–3) cost about the disjoint bound (56–129 probes against bounds of 66–147, including one query that learns the default action); occluded lists cost far more, growing with n and d as the (2n+1)^d sweep predicts: up to 1,455 probes for d = 2, n = 12 (bound 396), 33,018 for d = 3, n = 12 (bound 588) and 345,279 for d = 4, n = 12 (bound 588). This is the price of correctness for arbitrary overlap under the present algorithm; whether a poly(n, d, ω) algorithm exists is left for future work (Section 10.2).

9.11. A Real Iptables Firewall (E11, Theorems 2b, 3, 6 and Lemma 1)

To check that the exact-oracle model describes a real firewall, we built a testbed of three Linux network namespaces (e11_testbed.py, root required): a client, a firewall whose FORWARD chain holds the policy and which bridges the two sides at layer 2 (bridge-nf-call-iptables) so that every IPv4 header — including reserved addresses, protocol 0 and port 0 — is either forwarded or dropped by the chain alone, and a server that sniffs what arrives. Probes are real packets built with scapy; the action oracle MQ is whether the packet reaches the server; the identity oracle IDQ is the FORWARD rule whose hit counter incremented (iptables -nvxL after each probe). Four real chains from Section 9.7 (sargon, Synology, home user, Docker) were installed as the leaves of their canonical protocol-first Tree-Rule, one iptables rule per leaf and protocol (xt_iprange for arbitrary address ranges, xt_u32 for protocol 0), so a hit counter identifies a leaf and Theorems 2b, 3 and 6 can be run exactly as stated.

What the testbed does and does not test. The FORWARD chain holds the canonical Tree-Rule of each policy, one iptables rule per leaf and protocol, rather than the original rule list. This is a deliberate choice whose consequence should be stated plainly. Theorem 2b assumes an identity oracle that returns a leaf; installing the tree is the only way to obtain that oracle from iptables counters, because a counter on the original chain identifies a rule of an overlapping list, for which the relevant learner is CellSweep (Theorem 2a″), and Section 9.10 shows that its cost on chains of this size would be prohibitive. The testbed therefore validates two things: that real packets, a real kernel and real hit counters behave as the exact oracles MQ and IDQ of Section 3 (consistency 200/200 on every chain, no probe ever attributed to the wrong rule, counter delay never exceeding the retry window), and that the probe counts, certificate sizes and error bounds of Theorems 2b, 3 and 6 and the invisibility of Lemma 1 hold against real software rather than a simulated oracle. It does not test reconstruction of a legacy overlapping list from its own counters; that experiment awaits the poly(n, d, ω) algorithm of Section 10.2 and is the natural next step. Two remarks temper the limitation. The installed chain is semantically identical to the original, so the action oracle is that of the real policy in every case; and an operator who wants to expose a leaf-level identity oracle to auditors can deploy exactly the configuration used here — the policy compiled to its canonical tree, one rule per leaf — which is the deployment model of the Tree-Rule firewall [11,12,13,33,34].

Table 3 reports the results. The whole run takes ≈ 21 min and was executed independently on two machines — a Linux server (kernel 6.x) and a Windows 11 laptop running WSL2 Ubuntu 24.04 (kernel 6.6, with br_netfilter, xt_iprange and xt_u32 available) — with identical probe counts, certificate sizes and outcomes on every chain and wall-clock times within 15% (Table 3 gives both); both logs are in the repository.

Every reconstruction is exact, using 17–19 probes per leaf on the three larger chains (about half the bound, as in simulation); certificates raise no false alarm and detect all 24 injected faults; the shadowed rule never appears in a transcript; and the sampled-traffic reconstruction is essentially error-free at N = m. The certificate sizes are below 3m − 2 only because straddling packets coincide with leaf centers for the tiny leaves (single host, single port) of real policies and are counted once (Appendix A.4; e.g. 103 raw packets, 81 distinct for Synology). Throughput is 7–27 probes per second and is limited by reading the counter table through the iptables command (linear in the number of rules), not by the algorithms; the counter delay was never observed to exceed the 5 ms retry window, and no probe was ever attributed to the wrong rule. Two testbed lessons are worth recording. First, an IP-routing firewall would not have exposed the whole header space — the kernel drops martian sources and does not forward multicast, loopback or zero-network destinations before any rule is consulted — so we bridged instead; a real audit of a routed firewall must treat those addresses as outside the domain. Second, iptables interprets -p 0 as ‘all’, so protocol 0 needs a byte match. Both are model-vs-reality details of exactly the kind Section 10.1 anticipates. In operational terms, the testbed shows what a hit-counter audit of a firewall of this size costs today: from a few seconds (35-leaf policy) to about eight minutes (192-leaf policy) of probing at 7–27 packets per second, dominated by counter reads rather than by the algorithms, and a certificate replay of 4–405 packets that runs in under a minute; the same procedure applies to any firewall that exposes per-rule counters or flow logs (iptables, nftables, Cisco ACL hit counts, cloud security-group flow logs), and it needs no access to the rule text. The procedure presupposes, as the testbed does, that the counters identify leaves of a tree-shaped policy; on a legacy overlapping list the same counters identify rules, and the cost is that of Section 9.10. Table 4 summarizes all eleven experiments.

10. Discussion, Limitations and Future Work

10.1. Scope and Limitations

Our model is stateless filtering on integer header fields with an exact oracle. Stateful connection tracking, NAT, rule updates during probing, multi-chain iptables semantics (JUMP/RETURN), packet loss, rate limiting and delayed or noisy hit counters are outside it; Lemma 1 and Theorem 1 transfer verbatim; the reconstruction theorems do not, and the dependence on exactness is sharp: with identity answers corrupted independently with probability p, reconstruction error on an 86-leaf tree is 0.2% at p = 0.001 but 9.5% at p = 0.01 and 30% at p = 0.05 (Section 9.9(b)), because a single wrong answer inside a binary search misplaces a breakpoint. In the namespace testbed no misattribution was observed in 800 consistency probes, but a production firewall with concurrent traffic, delayed counter updates or sampled flow logs (as in cloud NSG logs) will not offer an exact identity oracle, and the O(log m) overhead of majority-vote repetition (Section 10.2) should be regarded as part of the real cost of Theorem 2b in such settings. The certificate of Theorem 3 uses only the action oracle and is unaffected. Witnesses per leaf are a modeling idealization of captured traffic; Theorem 6 quantifies the degradation when leaves are silent (guarantee exactly on the probed region, expected traffic-weighted error ≤ m/(eN)), and shows that certification against a specification needs no traffic at all. The m/(eN) bound assumes i.i.d. packets from a fixed distribution and is an expectation over that distribution — not a worst-case, pointwise or certification guarantee, and not a guarantee that every leaf is discovered. IDQ models hit counters, which are available to auditors but rarely to attackers. Experiments E1–E10 are exact simulations; Section 9.11 confirms Theorems 2b, 3 and 6 and Lemma 1 on a real iptables firewall in a namespace testbed with real packets and hit counters, but a deployed firewall adds rate limits, delayed counters and concurrent traffic that the testbed does not model. Claims of the form ‘audit’ and ‘reconstruct’ throughout refer to this model. On the theory side, the lower bounds of Theorems 2a′ and 2b lose a log n (resp. log m) factor from the information-theoretic argument, the constant in Theorem 3(b) is loose by a factor ≤ 3, Theorem 3 requires a reduced specification (Section 9.9, part (c), shows that this is not a mere technicality), and the overlapping-list algorithm of Theorem 2a″, though correct, is far from the lower bound.

10.2. Future Work

Overlapping listed rules. Theorem 2a″ reconstructs any overlapping list, but at O(d²n²(2n+1)^d log W) against a lower bound of only Ω̃(nd log W). Section 9.7 shows that this is the case that matters for cross-product production policies, where the list is far more succinct than any fixed-order tree; a bound of the form poly(n, d, ω)·log W, with ω the overlap depth, would decide whether identity feedback over the original list beats identity feedback over the tree, and would sharpen the auditing guidance of Section 1.3 for exactly the policies on which trees are large.

The auditor–attacker gap. Is Q(LEARN(TR_m, MQ + witnesses)) = Õ(m(log W + d)), i.e., is identity feedback inessential? The operational stake is direct: if yes, hiding hit counters from an adversary buys nothing beyond a polynomial factor and traffic confidentiality is the only lever a defender has; if no — as the m^d growth of Section 9.5 suggests — the identity channel is a genuine privilege of the auditor, exposing counters and flow logs is a measurable loss of security, and the number of header fields d becomes a defensive parameter. Either resolution changes what an operator should log and to whom.

Beyond these two questions, natural extensions are learners tolerant to noisy or delayed identity feedback (repeated queries with majority vote, or learning from counter differences), stateful and multi-chain semantics, the two-layer cloud policies of [37], removal of the residual logarithmic factors in the lower bounds, and the quantum query complexity of the same tasks, which we treat in companion work.

Appendix A.1. ProbeByPriority (Theorem 2a, Pairwise-Disjoint Listed Rules, IDQ + Witnesses)

Input: n, one witness h_i with IDQ(h_i) = i for every non-shadowed rule i; field widths W_j. Output: boxes B̂_i and actions â_i with f_P̂ ≡ f_P.

for i = 1..n: if rule i has no witness, set B̂_i = ∅ (the rule is shadowed and semantically inert). Otherwise, for j = 1..d: R ← BinarySearchRight(h_i, j, i); L ← BinarySearchLeft(h_i, j, i); Î_i^j ← [L, R]. Set B̂_i ← ∏_j Î_i^j and â_i ← MQ(h_i).

BinarySearchRight(h, j, i): lo ← h_j (predicate true), hi ← W_j (virtual false); while hi − lo > 1: mid ← ⌊(lo+hi)/2⌋; if IDQ(h[j←mid]) = i then lo ← mid else hi ← mid; return lo. BinarySearchLeft is symmetric with lo ← −1 (virtual false), hi ← h_j.

Invariant. Because rules are pairwise disjoint, E_i = B_i and IDQ(p) = i ⇔ p ∈ B_i. On the line {h_i[j←t]} the predicate IDQ = i is therefore true exactly on the interval I_i^j ∋ h_i^j and false elsewhere; it is monotone on [h_i^j, W_j) and on (−1, h_i^j], so each binary search returns the exact endpoint in ⌈log₂ W_j⌉ queries. Boundary cases: a singleton interval (I_i^j = {h_i^j}) is handled because the first probe on either side already fails; an interval touching 0 or W_j − 1 is handled by the virtual sentinels; distinct rules may share witness coordinates on some fields without effect, since each search is confined to its own rule's identifier.

Appendix A.2. TreeLearn-IDQ (Theorem 2b, Tree-Rule with Fixed Field Order, IDQ + Witnesses)

Input: one witness per leaf (any point of the leaf); IDQ returns leaf identifiers. Output: a Tree-Rule T̂ with T̂ ≡ f.

id[w] ← IDQ(w) for every witness (m queries). Build(j, Wits): if j = d return Leaf(MQ(Wits [0])). Sort Wits by coordinate j; groups ← [[Wits[0]]]; breaks ← []; for consecutive (w, w′): if IDQ(w[j←w′_j]) = id[w] then append w′ to the last group; else b ← BinarySearch(w, j, id[w], w_j, w′_j); append b to breaks and start a new group [w′]. Return Node(field j, breaks, [Build(j+1, G) for G in groups]).

Invariant. At a node v of the hidden tree testing field j, all witnesses passed to Build(j, ·) lie in v's region and every child of v contains at least one of them (every leaf has a witness). Two consecutive witnesses w, w′ lie in the same child iff IDQ(w[j←w′_j]) = id[w]: the probe keeps every coordinate of w except field j, so it stays in v's region, and below v field j is never tested again, hence the leaf identifier is constant on the segment of the line inside one child and changes when the segment crosses a breakpoint. Between different children the predicate IDQ(w[j←t]) = id[w] is true on [w_j, b) and false on [b, w′_j], i.e., monotone, so BinarySearch returns b exactly; there is exactly one breakpoint in (w_j, w′_j] because every child holds a witness. Children with a single leaf, nodes with a single child (k = 1, no breakpoints), duplicate coordinates on field j (two witnesses of different leaves with equal w_j necessarily lie in the same child and are grouped without a query beyond the pair test) and breakpoints at 1 or W_j − 1 need no special treatment. The recursion terminates because each call receives at least one witness and strictly increases j. Query count: m identifiers + at most d(m − 1) pair tests (m − N_j at each depth j, where N_j is the number of nodes at that depth; a single-child node pays its pair tests without contributing a breakpoint) + (m − 1) binary searches of at most ⌈log W⌉ queries each + m actions, i.e. (m − 1)(⌈log W⌉ + d) + 2m in total.

Appendix A.3. SliceLearn-MQ (Theorem 4, Tree-Rule, Action-Only Queries + Witnesses)

Learn(π, j, Wits): if j = d return Leaf(MQ(π)). Let v_1 < … < v_r be the distinct coordinates of field j among Wits; for each s: g_s ← Learn((π, v_s), j+1, {(π, v_s, w_{>j}) : w ∈ Wits}). Merge consecutive s with g_s ≡ g_{s+1} (decided offline by structural comparison of the learned subtrees). For each remaining consecutive pair with g_s ≢ g_{s+1}: compute offline a suffix y with g_s(y) ≠ g_{s+1}(y); binary-search field j on the line (π, ·, y) between v_s and v_{s+1} for the point where MQ changes; record it as a breakpoint. Return the node.

Invariant. Every projected witness (π, v_s, w_{>j}) stays in the same leaf as w: ancestors of the leaf do not test fields > j and its field-j interval contains v_s. Hence the recursive call receives a witness for every leaf under the child containing v_s (possibly several per leaf, which is harmless), and by induction g_s is exactly that child's subtree. On the line (π, ·, y) the function f changes only at breakpoints of the node testing field j, and exactly one lies in (v_s, v_{s+1}] because every child holds a witness; the predicate MQ(π, t, y) = g_s(y) is therefore monotone there. The cost recurrence T_j ≤ r·T_{j+1} + r⌈log W⌉ with r ≤ m gives O(m^d log W).

Appendix A.4. Certificate (Theorem 3, Reduced Specification g)

S ← ∅. For every leaf L of g add an interior point of L (its center). For every node v (field j, prefix π chosen as the center of v's region) and every breakpoint b of v between children c, c′: since g is reduced, g_c ≢ g_{c′}; compute a suffix y with g_c(y) ≠ g_{c′}(y) by intersecting the leaf regions of c and c′ and comparing actions; add (π, b − 1, y) and (π, b, y). Return S (duplicates removed). |S| = m + 2(m − 1) = 3m − 2. Boundary cases: a leaf that is a single cell contributes that cell; a breakpoint at b = 1 gives straddle points at 0 and 1; if two straddle points coincide with leaf centers they are counted once, which is why the experiments report up to two fewer packets than 3m − 2. Correctness relies only on the shape of g being known to the auditor (the specification is white-box; only the deployed policy is black-box), and the guarantee is complete for the structural-deviation class Dev(g); no fixed set smaller than |H| − 1 is complete for unrestricted deviations (Theorem 1(c)).

Appendix A.5. CellSweep (Theorem 2a″, Overlapping Listed Rules, IDQ + Witnesses)

Full proof of Theorem 2a″. Process rules in priority order; when rule i is processed, U = ∪_{k<i} B̂_k is known exactly as a union of at most i − 1 boxes, and it is enough to output B̂_i = hull(E_i), because E_i ⊆ hull(E_i) ⊆ B_i gives E_i = E_i \ U ⊆ hull(E_i) \ U ⊆ B_i \ U = E_i; moreover ∪_{k<i} hull(E_k) = ∪_{k<i} B_k, so the U used at step i is the true one. Membership in B_i is testable outside U: for q ∉ U, IDQ(q) = i iff q ∈ B_i (inside B_i no rule k > i can be the first match). Let the grid of field a be the set of intervals cut by the endpoints of the boxes of U (at most 2i − 1 intervals); U is a union of grid cells, so along an axis-j line through a fixed (d − 1)-cell C the covered set U_C is the same for every point of C, and its complement is a union of at most 2i testable intervals. Algorithm CellSweep (Appendix A.5) maintains H, the box hull of packets known to lie in E_i (initially h_i), and repeats until H stops changing: for every axis j, every (d − 1)-cell C and every testable interval I on the corresponding line, it probes q = (x*, t*), where x* is the point of C nearest to proj(H) coordinate-wise and t* the point of I nearest to H's j-range; if IDQ(q) = i it enlarges H by q and by the endpoints of [l_j, r_j] ∩ I found by binary search from t* (the predicate IDQ = i is monotone on I because I ∩ U = ∅ and B_i ∩ line is an interval). Correctness: H ⊆ hull(E_i) throughout, since only packets with IDQ = i are added. Conversely let p ∈ E_i and let C, I be the cell and testable interval of p for axis j. Because B_i is a box containing H and p, it contains hull(H ∪ {p}), hence x* ∈ proj(B_i) and t* ∈ [l_j, r_j]; and (x*, t*) ∉ U by the cell property. So the probe answers i and the binary search extends H's j-range to cover [l_j, r_j] ∩ I ∋ p_j. Repeating over the axes, every coordinate of p enters H's range within one round, so at a fixpoint H ⊇ E_i and H = hull(E_i). Termination and cost: each of the 2d endpoints of H moves monotonically outward and only to a true endpoint of B_i or to a grid coordinate, hence changes at most 2n + 3 times; a round costs d·(2n+1)^{d−1}·(2n+1)·(1 + 2⌈log W⌉) queries; so a rule costs O(d²·n·(2n+1)^d·log W) and the list O(d²·n²·(2n+1)^d·log W). The unoccluded case: Phase 1 first runs the Theorem 2a searches along the witness line, jumping over U-intervals; if on every side the search ends at a visible non-U packet outside B_i (or at the domain end without entering U), all 2d endpoints of B_i are exact, B̂_i = B_i, and the sweep is skipped. ∎

For i = 1..n (priority order): if rule i has no witness, B̂_i ← ∅ and continue. U ← {B̂_k : k < i}; grid_a ← intervals of field a cut by the endpoints of the boxes in U; H ← [h_i, h_i]^d. Phase 1: for each field j and direction, binary-search along the witness line as in A.1, jumping over U-intervals (test the nearest packet of the next testable interval; continue if it answers i); record whether the side ended at a visible exit. If all 2d sides are visible, B̂_i ← H and continue with i + 1. Phase 2 (sweep): repeat { changed ← false; for each field j, for each (d−1)-cell C of the grid on the other fields, for each testable interval I of the axis-j line through C: x* ← coordinate-wise nearest point of C to proj(H); t* ← nearest point of I to H's j-range; if IDQ(x*, t*) = i: extend H by (x*, t*) and by the two ends of the maximal sub-interval of I around t* on which IDQ = i (binary search); changed ← true } until not changed; B̂_i ← H.

Invariant. H ⊆ hull(E_i) (only packets answering i are added; hull(E_i) ⊆ B_i). Every packet probed lies outside U, where IDQ = i ⇔ membership in B_i; on a testable interval the predicate is monotone. At a fixpoint every p ∈ E_i satisfies p ∈ H by the nearest-corner argument of Theorem 2a″. Boundary cases: a rule whose witness line is entirely unoccluded never enters Phase 2; a testable interval reduced to one packet is probed once; the domain ends act as sentinels; a rule with an empty grid cell set (i = 1) has a single cell per axis and reduces to A.1.