Abstract: A network filter is implemented so that filter terms that include intra-term OR conditions and converted to sub-terms that include only logical AND conditions. In one implementation, a device may include logic to receive a filter definition including one or more terms, at least some of the terms including logical OR conditions, that define how network traffic through the device is to be filtered, the logic expanding the one or more terms in the filter such that terms that contain logical OR conditions are expanded into a plurality of sub-terms that each contains only logical AND conditions. The device may further include a ternary content-addressable memory (TCAM) programmed to include a separate entry corresponding to each of the sub-terms.

Abstract: A network filter is implemented so that filter terms that include intra-term OR conditions and converted to sub-terms that include only logical AND conditions. In one implementation, a device may include logic to receive a filter definition including one or more terms, at least some of the terms including logical OR conditions, that define how network traffic through the device is to be filtered, the logic expanding the one or more terms in the filter such that terms that contain logical OR conditions are expanded into a plurality of sub-terms that each contains only logical AND conditions. The device may further include a ternary content-addressable memory (TCAM) programmed to include a separate entry corresponding to each of the sub-terms.

Abstract: A network filter is implemented so that filter terms that include intra-term OR conditions and converted to sub-terms that include only logical AND conditions. In one implementation, a device may include logic to receive a filter definition including one or more terms, at least some of the terms including logical OR conditions, that define how network traffic through the device is to be filtered, the logic expanding the one or more terms in the filter such that terms that contain logical OR conditions are expanded into a plurality of sub-terms that each contains only logical AND conditions. The device may further include a ternary content-addressable memory (TCAM) programmed to include a separate entry corresponding to each of the sub-terms.

Abstract: A network device may be configured to filter network traffic using multiple different filters bound to different interfaces of the network device. The network device may include logic to identify a relationship map that describes a topology of bind-points associated with the network device. Additionally, the network device may include logic to generate a merge graph based on the relationship map, the merge graph including one or more nodes, where each node represents a walk through the relationship map and includes one or more merge-points, where each merge-point is defined as a filter associated with a bind-point. The network device may also include a ternary content-addressable memory (TCAM) programmed to include entries based on the nodes of the merge graph.

Abstract: A network device may be configured to filter network traffic using multiple filters bound to different interfaces, such as different ports or other logical interfaces associated with the network device. Multiple filters may be merged to obtain a number of merged filter sets. A rank may be calculated for the merged filter sets and used to maintain a required ordering of the merged filter sets when performing a lookup.

Abstract: A network device, such as a firewall, may be configured to filter network traffic. The filter may include regular expressions that are converted by the firewall into a format that can be stored in a ternary content addressable memory. In one exemplary implementation, the filter definition may include one or more input regular expressions that include variables that are compared to a result based on an equality/inequality relationship, where multiple variables are combined using logical operations selected from a set of logical operations including (but not limited to) logical AND and logical OR operations. The firewall may convert the input regular expressions into a format in which the equality/inequality relationships are converted to a pure equality relationship and the multiple variables are combined using only logical OR operations. The firewall may program the ternary content-addressable memory to implement the filter based on the converted one or more input regular expressions.