Fast network layer packet filter

A system for filtering a received packet, comprising:

• means for associating a first set of one or more network layer addresses with a first domain identifier;
• means for associating a second set of one or more network layer network addresses with a second domain identifier;
• means for associating a network protocol combined with a range of source port numbers and a range of destination port numbers with a protocol index;
• a filtering matrix including one or more entries, each one of said entries including a forwarding flag;
• means for determining that a network layer source address in said received packet is in said first set of one or more network layer addresses;
• means for determining that a network layer destination address in said received packet is in said second set of one or more network layer addresses;
• protocol domain determining means for determining that a protocol type of said received packet is equal to said network protocol, and that a source port number of said received packet is within said range of source port numbers, and that a destination port number of said received packet is within said range of destination port numbers;
• and
• means for generating an index into said filtering matrix responsive to said first domain identifier, said second domain identifier, and said protocol index.

A system for forming a packet filtering data structure, responsive to a command script, comprising:

• means for forming an address table having one or more entries, each address table entry including a domain prefix and a domain identifier;
• means for forming a two dimensional filtering matrix having one or more entries, each row in said filtering matrix indexed by one of said domain identifiers, and each said filtering matrix entry having a filtering flag;
• means for identifying a first row in said filtering matrix, identical with a second row in said filtering matrix, said first row indexed by a first domain identifier, said second row indexed by a second domain identifier;
• and
• means for deleting said second row from said filtering matrix, and for replacing said second domain identifier in said address table with said first domain identifier.

A system for forming a packet filtering data structure, responsive to a command script, comprising:

• means for forming an address table having one or more entries, each address table entry including a domain prefix and a domain identifier;
• means for forming a protocol table having one or more entries, each protocol table entry including a protocol type, port range, and associated protocol domain identifier;
• means for forming a two dimensional protocol vector having one or more entries, each entry in said protocol vector indexed by a pair of said protocol domain identifiers, each protocol vector entry including a protocol index;
• means for forming a three dimensional filtering matrix having one or more entries, a first and second dimension in said filtering matrix indexed by a first and a second one of said domain identifiers, a third dimension in said filtering matrix indexed by a protocol index, and each said filtering matrix entry having a filtering flag;
• means for identifying a first plane in said filtering matrix, identical with a second plane in said filtering matrix, said first plane indexed by a first protocol index, said second plane indexed by a second protocol index;
• and
• means for deleting said second plane from said filtering matrix, and for replacing said second protocol index in said protocol vector with said first protocol index.

A method of filtering a packet received at a device comprising the steps of:

• extracting a source address and a destination address from said packet;
• identifying a source domain identifier and a destination domain identifier associated with said source address and destination address, respectively;
• retrieving one entry, of a plurality of entries in a filtering matrix as a function of said source and destination domain identifiers, each entry comprising a forwarding flag;
• and
• forwarding said packet if said forwarding flag in said retrieved entry is equal to a first value.