. The application will therefore tell the designer whether it is acceptable to interrupt the system CPU often or whether it is preferable to provide the design with a dedicated coprocessor card (in another slot) where this type of processing can occur without penalizing the host CPU. An example of such requirements could be some sophisticated firewall functionality. Typical fire- wall functionality can be described as a series of address and port-based filters that are expected to run on the NPU at each line card. Access control lists (ACLs) can be easily maintained by the NPU. However, more sophisticated firewalls adopt the stateful inspection method pioneered by CheckPoint Software. In such an environment, lots of session-related information must be retained in special (and numerous) data structures. Remember that Agere's approach is not optimized for the proper termina- tion (including the setup and tear down) of TCP sessions. If high-speed stateful inspection function- ality is desired, then not that many choices are available. Parts of the stateful-inspection-based application code will therefore have to run on a beefed-up system host CPU card or on a firewall- coprocessor card in a separate slot. Another point of interest is Network Address Translation (NAT), which should run on the line cards at least partially. As soon as the start of an NAT session is detected by the NPU, it is flagged to the host CPU on the line card, which steps in and sets it up properly. An alternative is to have the trans- lation table locally stored. The NPU would not only perform the classification, but it would also han- dle the address-bit-fields swapping and the forwarding. It is also interesting to note that the network processor can handle all Ethernet address learning and aging on the wire-speed path, if necessary, as a design option. This can also be done on a control plane CPU. The former can be accomplished by stealing cycles from the engine that does the policing. Similar considerations will have to be entertained mental