Rule tree for network device

A network device comprising:

• a communication interface to receive a packet;
• and
• a processor, implemented at least partially in hardware, to:
• determine a plurality of characteristics of the packet,
• search a first tree structure for a rule matching the plurality of characteristics,
• search a second tree structure for the rule matching the plurality of characteristics,
• the second tree structure being separate from the first tree structure, and
• perform an action when the rule matching the plurality of characteristics is found in the first tree structure or the second tree structure,
• the first tree structure storing a first plurality of rules that correspond to at least one of a plurality of criteria types,
• the plurality of criteria types including:
• a destination address,
• a source address,
• a source port,
• a destination port, and
• a protocol type,
• a criteria type, corresponding to a top level of a first plurality of levels in the first tree structure, having a higher priority than at least one different criteria type that corresponds to another level of the first plurality of levels in the first tree structure,
• the second tree structure storing a second plurality of rules that correspond to at least one of the plurality of criteria types, and
• a criteria type, corresponding to a top level of a second plurality of levels in the second tree structure, having a higher priority than at least one different criteria type that corresponds to another level of the second plurality of levels in the second tree structure.

A method comprising:

• receiving, by one or more devices, a packet;
• determining, by the one or more devices, a plurality of characteristics of the packet;
• searching, by the one or more devices, a first tree structure for a rule matching the plurality of characteristics,
• the first tree structure storing a first plurality of rules,
• a first criteria type, corresponding to a top level of a first plurality of levels in the first tree structure, having a higher priority than other criteria types corresponding to other levels of the first plurality of levels in the first tree structure;
• searching by the one or more devices, a second tree structure for the rule matching the plurality of characteristics,
• the second tree structure being separate from the first tree structure,
• the second tree structure storing a second plurality of rules,
• a second criteria type, corresponding to a top level of a second plurality of levels in the second tree structure, having a higher priority than other criteria types corresponding to other levels of the second plurality of levels in the second tree structure;
• and
• performing, by the one or more devices, an action when the rule matching the plurality of characteristics is found in the first tree structure or the second tree structure.

A system comprising:

• a device, implemented at least partially in hardware, to:
• receive a packet;
• determine a plurality of characteristics of the packet;
• search a first tree structure for a rule matching the plurality of characteristics,
• the first tree structure storing a first plurality of rules,
• each of the first plurality of rules having a first type of criteria of a plurality of types of criteria,
• the plurality of types of criteria comprising:
• a destination address,
• a source address,
• a source port,
• a destination port, and
• a protocol type,
• the first tree structure comprising a first plurality of levels,
• the first plurality of levels corresponding to the plurality of types of criteria, and
• when searching the first tree structure, the device is to:
• search the first plurality of levels in the first tree structure;
• search a second tree structure for the rule matching the plurality of characteristics,
• the second tree structure being separate from the first tree structure,
• the second tree structure storing a second plurality of rules,
• one or more of the second plurality of rules including a second type of criteria,
• the second type of criteria being a type of criteria from the plurality of types of criteria,
• the second type of criteria being different from the first type of criteria,
• the second tree structure comprising a second plurality of levels,
• the second plurality of levels corresponding to the plurality of types of criteria, and
• when searching the second tree structure, the device is to:
• search the second plurality of levels in the second tree structure;
• and
• perform an action when the rule matching the plurality of characteristics is found in the first tree structure or the second tree structure.