Patent ID: 8627448

Claim:
A network node for selective invalidation of packet filtering cache results based on rule priority, the network node comprising: a cache of results of a packet filtering rule set to store a plurality of entries, each cache entry including a rule identifier of a packet filtering rule to which the cache entry relates and a rule set version identifier that identifies a version of the packet filtering rule set when the cache entry was created; a version memory to store a highest priority rule modified for each of a plurality of rule set version identifiers; a current rule set version identifier identifying a current version of the packet filtering rule set; and a packet processor to: determine, when a cache entry corresponding to a received packet is included in the cache, whether the rule identifier included in the cache entry is of a higher priority than a highest priority rule stored in the version memory for the rule set version identifier included in the cache entry, and apply, to the packet, an action included in the cache entry when the rule identifier included in the cache entry is of a higher priority.