Method and apparatus for classifying packets

A non-transitory computer-readable medium storing instructions which, when executed by a processor, cause the processor to perform operations for processing a packet, the operations comprising:

• processing the packet through a software-based packet classifier, wherein the packet was previously processed through a hardware-based packet classifier having an evolving rule, wherein the evolving rule is updated periodically in accordance with sample packets that are obtained within a sampling time interval, wherein the evolving rule is for matching a plurality of received packets from different flows, wherein each of the different flows comprises packets with a same projection, wherein the hardware-based packet classifier comprises a register for storing the evolving rule, and wherein the hardware based packet classifier was unable to classify the packet, wherein the software-based packet classifier comprises a plurality of rules associated with packet classification, wherein each rule of the plurality of rules comprises a predicate and an action, wherein each predicate comprises a plurality of literals defined over a plurality of packet header fields, wherein each literal comprises a range defined by at least two values of one of the plurality of packet header fields, wherein a rule of the plurality of rules is evaluated for a match to the packet when a predicate of the rule matches a projection of the packet, and wherein the evolving rule is derived from at least two of the plurality of rules.

A system for classifying a plurality of received packets, comprising:

• a hardware-based packet classifier storing an evolving rule for classifying the plurality of received packets, wherein the evolving rule is updated periodically in accordance with sample packets that are obtained within a sampling time interval, wherein the evolving rule is for matching a plurality of received packets from different flows, wherein each of the different flows comprises packets with a same projection, wherein the hardware-based packet classifier comprises a register for storing the evolving rule;
• and
• a processor and a computer-readable medium in communication with the processor, the computer-readable medium storing instructions which, when executed by the processor, cause the processor to implement a software-based packet classifier for processing any packets of the plurality of received packets that are unable to be classified by the hardware-based packet classifier, wherein the software-based packet classifier comprises a plurality of rules associated with packet classification, wherein each rule of the plurality of rules comprises a predicate and an action, wherein each predicate comprises a plurality of literals defined over a plurality of packet header fields, wherein each literal comprises a range defined by at least two values of one of the plurality of packet header fields, wherein a rule of the plurality of rules is evaluated for a match to the packet when a predicate of the rule matches a projection of the packet, and wherein the evolving rule is derived from at least two of the plurality of rules.