1. A method comprising: receiving, by one or more devices, a packet; determining, by the one or more devices, a plurality of characteristics of the packet; searching, by the one or more devices, a first tree structure for a rule matching the plurality of characteristics, the first tree structure storing a first plurality of rules, each of the first plurality of rules having a first type of criteria of a plurality of types of criteria, the plurality of types of criteria comprising: a destination address, a source address, a source port, a destination port, and a protocol type, the first tree structure comprising a first plurality of levels, the first plurality of levels corresponding to the plurality of types of criteria, and searching the first tree structure including: searching the first plurality of levels in the first tree structure; searching, by the one or more devices, a second tree structure for the rule matching the plurality of characteristics, the second tree structure being separate from the first tree structure, the second tree structure storing a second plurality of rules, one or more of the second plurality of rules including a second type of criteria, the second type of criteria being a type of criteria from the plurality of types of criteria, the second type of criteria being different than the first type of criteria, the second tree structure comprising a second plurality of levels, the second plurality of levels corresponding to the plurality of types of criteria, and searching the second tree structure including: searching the second plurality of levels in the second tree structure; and performing, by the one or more devices, an action when the rule matching the plurality of characteristics is found in the first tree structure or the second tree structure.