The security of an organisation's network can be improved by placing a
packet filter between it and any external network.  A packet filter
examines each incoming and outgoing network packet, and determines
whether to discard or forward it by looking up a rulebase of
access-control rules.  However, rule lookup in software is slow and
suffers from overheads.  Specialised hardware solutions are orders of
magnitude faster, but are expensive and inflexible.

Field programmable gate arrays (FPGAs) may provide a better solution
to the problem of lookup latency.  FPGAs are a form of programmable
logic that can be used to create custom hardware.  They are cheap and
can be quickly and easily reprogrammed (reconfigured).  Consequently,
they may provide a high-speed, low-cost and flexible solution to
packet filtering.

This research is an initial investigation into taking advantage of the
reconfigurability of FPGAs to enable a high-speed rule lookup
solution.  Its goal is to determine the feasibility, performance,
benefits and costs of the approach for TCP/IP packet filtering.

The approach was found to be technically feasible, relatively cheap,
and to provide good lookup performance, while requiring modest amounts
of FPGA logic capacity.  Consequently, further research into the
approach is justified and highly recommended.