ve been used in this definition. These words were used on purpose SO let's individually define them for this context: Distinguished means that implicitly different processing awaits each packet after it is singled out from a stream. These different types of processing correspond to flows. Several means that the deep packet classification process will usually occur based on the simulta- neous application of more than one rule and criterion. This is unlike classification, which is only based on rules surrounding layers 2 and 3. Internal means that the bit fields, which the classifier seeks to retrieve in order to apply some of its classification rules and criteria on them, may be buried deeper inside the received packet than the traditional source and destination addresses, which are conveniently located in well-known posi- tions in front of the payload. The bit fields needed sometimes carry a substantial amount of unre- lated material that is piled up on top of them. This unrelated material could also envelope the fields of interest in tunneled or encapsulated applications such as some firewall or virtual private network (VPN) products. They also cannot be easily seen by most network equipment, which SO far has only relied on using information from other previously easily accessible header fields. Variable length or format implies that the bit fields used in the rules applied to deep packet classi- fication are not as straightforward as frozen 32-bit addresses, but they can represent ranges of val- ues and can sometimes be of variable length (such as Uniform Resource Locators [URLs]). Deep packet classification is required in cases where multiple rules must be applied to a combi- nation of bit fields found directly inside a packet or calculated according to some quick procedure from the bit content of specific positions inside the packet. These bit fields reflect parameters per- taining to information that is specific to anywhere between layers 4 and 7. Therefore, it is not sur- prising that we encounter deep pack