ic event is extremely unpredictable, as is the case when pack- ets arrive at a network node where a switching/routing device is located, then the shape and form of the outcome (in this case, the packet content) is hard to profile. Consequently, several rules may be needed to cope with all the possible combinations of factors and parameters that lead to a classification decision. These rules must be stored somewhere in a lookup table or a rule database. They must be made available on an ongoing basis and be accessible at very high speeds in order to facilitate the process. This rule database must then be searched every time an event in need of classification arises. In network processing, the arrival of a new packet is an exam- ple of a dynamic event in need of classification. When network gear receives a packet among billions of other packets per second, it must decide within a very short time (a few nanoseconds) whether and how to forward each individual packet, how to process it, and SO on. This constitutes the underlying realm of the classification problem. The combination of a rule database and decision engine has cre- ated the concept of search and classification. In the previous chapter, we discussed search engines as one of the two legs required to success- fully tackle search and classification in the context of network processing. In this chapter, we look at the second leg of the approach. We first define some terms and formulate the problem of classifica- tion. We then discuss various approaches and provide configurations for tackling it. We conclude chapter with a case study of state-of-the-art classification processors to give a sense of the direction that the industry has taken. TWO TYPES OF PACKET CLASSIFICATION So what exactly do we mean by classification? The trade press and industry use some of the terms regarding classification in contradictory ways, causing some confusion. We must clarify that the terms lookup and search refer to the same thing in this book. The implementation of lookup and sea