ng a set of application-specific sorting rules and policies continuously and indiscriminately to all packets (hence the term classification), it ends up compiling a series of new (parallel) packet streams (queues of packets) in its output. The packets of each individual output stream or queue (although potentially belonging to completely unrelated sessions, hosts, and/or users) will all share the same fate and short-term destiny. As a result of classification, the packet is forwarded to the appropriate output queue of the classification engine. Downloaded from Digital Engineering Library @ McGraw-Hill (www.digitalengineeringlibrary.com) Copyright © 2004 The McGraw-Hill Companies. All rights reserved. Any use is subject to the Terms of Use as given at the website. SEARCH ENGINES 220 NETWORK PROCESSORS Given a specific application context, a few steps must be taken in order to correctly handle the classification and forwarding tasks for each individual packet that the network-processing subsystem of a high-speed switching/routing system receives. The NPU must consult a specialized memory bank, some sort of a knowledge base, a lookup table, an information base, or even a database where the appropriate rules are stored. These rules indicate how each arriving packet must be treated and processed prior to its being forwarded to the corresponding queue for subsequent processing. For example, a virtual private network (VPN) box will at least have to look at the destination address field of each arriving packet and decide for every packet whether it must be treated securely. This decision is based on the policy tables that it was given at configuration time. If it must be treated securely, it will be steered to queue A, where secure packets are lined up. If it does not need to be treated securely, it will go to queue B. Once it arrives at queue B, it must decide whether it will be filtered and discarded or filtered and logged to a security management resource. Likewise, a Multiprotocol Label Switching (MPLS) switch looks 