Abstract: At least a portion of the data units in a bridge/router device are analyzed for purposes of filtering by employing high speed logic circuits. A data unit is analyzed by such logic circuits by examining the header portion of the data unit, employing information obtained from the header portion to designate possible output ports for transmission of the data unit, examining a predefined per-port filter enable indicator to determine whether filtering is to be applied to the data unit, and applying filtering for each respective port for which the per-port filter enable indicator indicates that filtering is to be applied. Filtering is also implemented with logic circuits and executed at high speed. Filtering may be executed based on MAC address group, port group, combination MAC address and port group, protocol type, and non-unicast traffic frequency. Data units that cannot be analyzed by the logic circuits are analyzed by software.