Adaptive re-ordering of data packet filter rules

A data packet filter for implementing a security policy comprising:

• a memory for storing a plurality of ordered rules and match data indicating the number of times each of said rules is matched by a data packet;
• a filter module for sequentially applying said rules to received data packets;
• and
• a re-ordering module for re-ordering said ordered rules such that rules which are matched more often are evaluated earlier.

A computer readable medium storing computer program instructions which are executable on a computer system implementing a data packet filter, said computer program instructions comprising instructions defining the steps of:

• filtering received data packets by sequentially applying a plurality of ordered rules, said rules defining a security policy;
• dynamically maintaining, during operation of said computer system, match data indicating the number of times each of said rules is matched by a data packet;
• and
• automatically re-ordering said ordered rules such that rules which are matched more often are applied earlier.

A firewall for filtering data traffic between a first network and a second network comprising:

• an input port for receiving data packets;
• a memory storing a plurality of ordered rules defining a security policy of said firewall;
• a filter module for sequentially applying said ordered rules to received data packets;
• an activity module for dynamically maintaining match data indicating the number of times each of said rules is matched by a data packet;
• and
• a re-order module for automatically re-ordering said plurality of rules such that rules which are matched more often are evaluated earlier.

An apparatus for filtering data packets received from a network in accordance with a security policy, said apparatus comprising:

• storage means for storing a plurality of rules in an order, said rules and said order defining said security policy;
• filter means for sequentially applying said rules in said order to received data packets;
• means for dynamically maintaining data indicating the number of times each of said rules is matched by a data packet;
• and
• re-ordering means for automatically re-ordering said plurality of ordered rules such that rules which are matched more often are placed earlier in said order.