1. A rules engine for the examination of selected fields in an addressed data packet, comprising: an access control list table containing entries each defining an access control list rule, a respective first action and a chain identifier; and an extension rule table for entries each defining an extension rule, a respective second action and a respective rule identifier wherein the rules engine is operative: (a) to search said access control list table to ascertain a match between an access control list rule and said addressed data packet; (b) to search said extension rule table to ascertain a match between an extension rule and said addressed data packet; in the event of a matched access control list rule matched to said addressed data packet to prescribe: (ci) the respective second action associated with a matched extension rule in the event of correspondence between the associated chain identifier and a rule identifier identifying a match between that matched extension rule and said addressed data packet; or (cii) the respective first action associated with said matched access control list rule in the absence of said correspondence.