9. An apparatus, comprising: means for receiving a packet having a plurality of fields in a header of the packet; means for defining at least one packet classification rule using a command-line interface (CLI), wherein the at least one packet classification rule comprises a structured part and an unstructured part, the structured part having a predetermined logical operator relation between at least two of the plurality of fields, the unstructured part having a user configurable relation among the plurality of fields; means for performing a first classification of the packet based on the structured part of at least one packet classification rule; means for using the predetermined logical operator relation between the at least two of the plurality of fields for the structured part in the first classification to provide a first classification result; means for performing a second classification of the packet based on the unstructured part of the at least one packet classification rule and the first classification result; and means for using the user configurable relation among the plurality of fields with keywords identifying values in the plurality of fields for the unstructured part in the second classification, wherein the first and second classifications form a classification of the packet.
15. The apparatus of claim 9 ,wherein the unstructured part of the at least one packet classification rule comprises structured rules as variables.