1. A method for generating, from user-entered rules, filtering rules for execution in an operating system kernal to filter an IP packet received at a physical interface to said operating system kernal, comprising the steps of: compiling said user-entered filtering rules into sets of binary symbolic and image files, with one said set for each said physical interface for which there exist said user-entered rules; upon starting said physical interface to said operating system kernal, resolving filtering rules in said symbolic file to form resolved 6-tuple filtering rules in image format, and loading to said operating system kernal said resolved 6-tuple filtering rules and 6-tuple filtering rules from said image file; said 6-tuple filtering rules in image format including an operator field and, selectively, a next rule field, an offset field and zero or more parameter value fields; said operator field comprising a function index that is resolved to a function pointer upon being loaded to memory in said operating system kernal; said next rule field selectively comprising a pointer to a first 6-tuple of a next rule; said offset field selectively representing an offset into an IP packet to be checked by this 6-tuple; and a first said parameter value field comprising a value to be compared against the field in said IP packet accessed by said offset field.