Patent ID: 7478426

Claim:
A method for applying a plurality of rules organized into a first decision tree to data packets within a network computer system, wherein the first decision tree has a plurality of chained branches of filter rules, each branch having a depth value defined by a number of linked pointers leading from a root of the tree to a tip of the branch, comprising: setting a worst case tree depth threshold equivalent to a depth value of a longest chained branch of the first decision tree; deleting one of the plurality of filter rules or adding a new rule; if deleting the one of the plurality of filter rules, providing an incremental delete of the one filter rule from the first decision tree to a network data plane processor for application to network data packets; and if adding the new rule, adding the new rule to a branch of the first decision tree to form an enlarged branch; determining a total rule depth of the enlarged branch; comparing the enlarged branch total rule depth to the worst case tree depth threshold; and: if the enlarged branch total rule depth is less than or equal to the worst case tree depth threshold providing an incremental insertion of the one filter rule to the first decision tree to a network data plane processor by providing a definition of a decision node added to the enlarged branch of the first decision tree to the network data plane processor, wherein the new decision node is inserted into a copy of the decision tree local to the network data plane processor; or if the enlarged branch total rule depth is greater than the worst case tree depth threshold, rebuilding the plurality of rules and the added new rule into a second decision tree; providing the second decision tree to the network data plane processor; and setting the worst case tree depth threshold equivalent to a depth value of a longest chained branch of the second decision tree.