ESSORS 249 The same principle can be applied in three or more dimensions, which ultimately leads to a set of complex multidimensional regions that correspond to specific actions to be taken following unequiv- local classification. By applying methods of computational geometry to parameterize these regions and weighing the pros and cons of the computational load of the regions as the probabilities that a cer- tain percentage of arriving packets are classified consistently into one or the other of these regions, we hope to identify ways of balancing the classification workload and optimizing the performance. CLASSIFICATION BASED ON MULTIPLE FIELDS Classification based on multiple fields is an extension of our discussion SO far. A packet header carries multiple fields, such as layer 3 source and destination addresses, layer 4 port source and destinations, layer 4 type of protocol, TOS, and SO on, all or some of which are important in the newer generations of network equipment. A classifier must apply elaborate and often numerous rules on these multiple fields in order to produce (according to the encoded policy rules) the appropriate action to be taken on each packet. This is a process that cannot be characterized as a best-efforts work. If a firewall is set up, the firewall is expected to be able to decide whether to accept or whether to filter each indi- vidual packet it encounters. To rate algorithms in this area, we must look predominantly at the wire-speed performance of the algorithm and subsequently at the cost of implementation, which in this case implies the memory needed for the algorithm to work (the footprint for both instruction memory and working data mem- ory). Other characteristics of interest are the setup time of the algorithm (also known as the prepro- cessing time) and the incremental update time when table content must change. The two characteristics are considered differently depending on whether the application is based on policy rule tables that change often. The data structure on which the c