Patent ID: 8042167

Claim:
A method for producing a performance optimized firewall policy and for filtering network packets using the policy, the method comprising: defining a firewall policy including an ordered list of firewall rules; for each rule, defining a first match probability indicating the likelihood that the rule will be the first match for a given packet; sorting neighboring rules in the ordered list in order of non-increasing probability for the first match probabilities and in a manner that preserves the firewall policy; and storing the sorted rules in memory of at least one firewall node, filtering, using a processor of the at least one firewall node, packets in a network using the sorted rules, and performing one of: intrusion detection, intrusion protection, and packet blocking based on results of the filtering, wherein filtering the packets using the sorted rules includes applying the rules to each packet in an order defined by the sorted list until a match is found, which results in a lower average number of comparisons per packet than filtering packets using the unsorted list.