An apparatus for classifying a data packet includes an interface for receiving the data packet; a classification controller for parsing the data packet to identify a plurality of data items required for classifying the data packet; memory for storing a set of range identifiers for each data item in the data packet corresponding to a rule range defined in the rule sets; and a controller for performing a preliminary test of at least one of the data items to determine whether any of the data item's values match known frequently-occurring values for that data item.