Cooperated approach to network packet filtering

A system, comprising:

• a central processing unit (CPU) communicatively coupled to a network interface apparatus;
• a system memory;
• and
• the network interface apparatus comprising a first-level matching logic to:
• determine whether a first network packet, received from a network, matches under a first-level policy;
• forward the first network packet to a second-level matching logic to enforce a second-level policy on the first network packet if the first network packet doesn't match under the first-level policy;
• and,
• forward the first network packet to a virtual machine (VM) if the first network packet matches under the first-level policy.

A method for filtering packets by a network interface apparatus, the method comprising:

• determining, by a first-level matching logic of the network interface apparatus, whether a first network packet, received from a network, matches under a first-level policy;
• forwarding, by the first-level matching logic, the first network packet to a second-level matching logic to enforce a second-level policy on the first network packet if the first network packet doesn't match under the first-level policy;
• and,
• forwarding, by the first-level matching logic, the first network packet to a virtual machine (VM) if the first network packet matches under the first-level policy.