As Internet packet flow increases, the demand for high speed packet
filtering has grown. The present invention introduces a high-speed rule
processing method that may be used for packet filtering. The method
pre-processes a set of packet filtering rules such that the rules may be
searched in parallel by a set of independent search units. Specifically,
the rules are divided into N orthogonal dimensions that comprise aspects
of each packet that may be examined and tested. Each of the N dimensions
are then divided into a set of dimension rule ranges. Each rule range is
assigned a value that specifies the rules that may apply in that range.
The rule preprocessing is completed by creating a search structure to be
used for classifying a packet into one of the rule ranges in each of the
N dimensions. Each search structure may be used by an independent search
unit such that all N dimensions may be searched concurrently. The packet
processing method of the present invention activates the N independent
search units to search the N pre-processor created search structures. The
output of each of the N search structures is then logically combined to
select a rule to be applied.