1. A method comprising, providing a plurality of bins stored in a memory, each of the bins including a number of rules, each rule specifying a source port range and a destination port range; identifying, from the plurality of bins, a bin corresponding to a network path and a protocol of a received packet; comparing a source port and a destination port of the received packet with the rules of the corresponding bin; and if the source port of the received packet is within the source port range of a rule and the destination port of the received packet is within the destination port range of the rule, applying an action associated with the rule to the received packet; wherein identifying a bin corresponding to a network path and a protocol of a received packet comprises: searching a source address data structure to find a first index and a third index, the first index associated with a fully specified filter having a source prefix matching the source address of the packet, the third index associated with a partially specified filter having a source prefix matching the source address of the packet; searching a destination address data structure to find a second index and a fourth index, the second index associated with a fully specified filter having a destination prefix matching the destination address of the packet, the fourth index associated with a partially specified filter having a destination prefix matching the destination address of the packet; forming a key from the first index, the second index, and the protocol; and searching a primary table for an entry matching the key, the primary table including a number of entries, each entry corresponding to one of a fully specified filter, a fully specified filter intersection, and an indicator filter; wherein an entry of the primary table matching the key will identify the corresponding bin.