the present invention provides an improved method and system for handling rule changes that efficiently supports frequent incremental updates . the method and system are based on the fact that a slightly sub - optimal tree structure can be tolerated with very little impact to search latency . the present invention thus responds to each individual rule insertion or deletion according to the same procedures used in a fixed match ( fm ) tree . fm trees are more fully described in commonly - assigned u . s . pat . no . 6 , 675 , 163 , issued jan . 6 , 2004 to bass et al . for “ full match ( fm ) search algorithm implementation for a network processor ”, which is hereby incorporated by reference into this description as fully as if here represented in full . what is new in the present invention is a system and method for supplementing prior art procedures to determine whether or not the insertion of a new rule can be made without rebuilding the table . in a preferred implementation , the deletion of a rule will never require rebuilding the table , since it can only make a tree branch shorter . alternatively , the insertion of a new rule will make a tree branch longer by adding one new node at the end of the closest matching branch . this insertion point is determined by identifying the last node visited while doing a search for the entry . note that the search will be unsuccessful , since the entry hasn &# 39 ; t been added yet . it will follow a linked list of pointers in the patricia tree structure ending at a table entry that causes a “ miscompare .” it is conventional for network hardware to remember the last node in the patricia tree ( the one pointing to the table entry that caused miscompare ). however , if the insertion doesn &# 39 ; t impact the previously longest branch of the tree , it will not increase the worst - case latency . accordingly , in one embodiment of the present invention a test is applied whenever a rule is inserted to determine the number of chained pointers required to solve a search to the new rule . if the resulting tree depth is greater than the tolerable worst - case tree depth , the tree is rebuilt by the control point . an important advantage of the present invention is that the test insertion and rule check may be done in the control point , and the decision made about rebuilding the table can be made without disrupting the data plane . according to the present invention a “ tolerable worst case ” tree depth is determined each time the tree is rebuilt , and is preferably set responsive to the longest chain of pointers in the current tree . in some embodiments the worst case tree depth is set equivalent to the length of the current longest chain of pointers : thus if the new rule is added to a smaller chain in the current chain no rebuild is indicated . alternatively , worst case tree depth may also be set to a growth factor “ n ” links longer than the current longest chain to increase the number of updates that can be handled without rebuilding the table . the growth factor n may be fixed ( exemplary values include 1 or 6 ) or it may be responsive to table size , preferably made smaller as a table gets larger , since a smaller table is more likely to insert on the longest branch and also requires more room to grow than a larger table . the worst case tree depth may also be set to a minimum value mv independent of the current longest chain value , in order to ensure room for growth . in an alternative embodiment of the present invention rebuilding the table may be indicated once for every m insertions , where m may be a constant or may be a function of the table size . what is important is that in the present invention the number of times a table must be rebuilt is significantly reduced , over potentially several orders of magnitude , compared to prior art systems , and thus it is practical to support highly dynamic rule changes while still maintaining control over worst - case search latencies with the system and method of the present invention . referring now to fig2 , according to the present invention a network administrator 212 inputs rule changes to the control plane processor (“ control point ”) 214 of the network processing system 10 , and the control point 214 responsively coordinates any required updates to one or more tables 230 , the tables 230 accessible by one or more data plane processors 242 defining a data plane 240 , wherein the data plane is interfaced with one or more network ports 250 in the gateway 13 . the control point 214 responsively sets up appropriate tables or other appropriate search structures , enabling the data plane processors 242 to independently apply the responsively updated or changed rules to each packet forwarded by the data plane 240 . fig3 is a flow chart diagram representation of the determination of a decision tree rebuild responsive to a rule change according to the present invention . when a rule change request 102 is received by the control point , a type determination 104 is made as to whether an old rule is being removed or a new rule is being added . if an old rule is being removed , then an incremental delete command is passed directly to the data plane at step 106 , and an appropriate data plane resource removes the corresponding rule from the active table ; the algorithm 100 then ends at step 108 . however , if a new rule is being added into the search structure as determined at step 104 , the control point responsively increments a parameter at step 110 . the control point then compares the incremented parameter to a previously established threshold at step 112 . if the parameter is lower than or equal to the threshold , then an incremental insert command is passed directly to the data plane at step 114 , and an appropriate data plane resource inserts the corresponding rule in the active table . alternatively , if the determination is made that the new pointer chain length is greater than the threshold , then the entire rule table is rebuilt at step 120 . the new table / tree is then transferred to the data plane table memory at step 122 . it is preferred , although not required , that the threshold is set responsive to the current table . accordingly , it is preferred that when the new tree structure is constructed in step 120 that the threshold is also recalculated responsive to at least one characteristic of the rebuilt tree , and the recalculated threshold utilized in the next iteration of step 112 . fig4 illustrates one rule update procedure algorithm 300 according to the present invention carried out by a control point 214 in response to requests from a network administrator or other controlling entity . it is important to note that the desire to support fast incremental updates may be partially driven by applications requiring automated control of rule changes rather than being driven by human interaction . according to the present embodiment , when a rule change request 302 is received by the control point , a type determination 304 is made as to whether an old rule is being removed or a new rule is being added . if an old rule is being removed , then an incremental delete command is passed directly to the data plane at step 306 , and an appropriate data plane resource removes the corresponding rule from the active table ; the algorithm 300 then ends at step 308 . note that this action will always result in a shorter chain of pointers to all remaining rules downstream from the deletion point , and will not affect the length of the pointer chain ( depth of tree ) for all other rules . thus , if the search latency was acceptable for achieving a specific performance level before the delete action ; the search latency will also be acceptable after the delete action , since it will be less than or equal to the previous search latency . alternatively , if a new rule is being added into the search structure , according to the present embodiment 300 search latency to resolve the new rule may be longer than a previous worst case latency , but search latency for previously existing rules , except for the one rule at the insertion point , is not affected since the rule is always inserted at the end of a tree branch . to prevent search latency from growing without bounds , it is preferred that a threshold is established at the time the table is built to limit the allowable tree depth . thus if a new rule is being added into the search structure as determined at step 304 , the control point computes the length of the pointer chain responsive to the new rule at step 310 . the control point then compares the pointer length to the previously established threshold at step 312 . if the new pointer chain length ( tree depth ) is lower than or equal to the threshold , then an incremental insert command is passed directly to the data plane at step 314 , and an appropriate data plane resource inserts the corresponding rule in the active table . alternatively , if the determination is made that the new pointer chain length is greater than the threshold , then the entire rule table is rebuilt at step 320 to attempt to better balance the tree depth . once the new tree structure has been constructed , the longest tree branch is identified . the tree depth threshold is then updated in step 322 , preferably set responsive to the longest chain of pointers in the new tree . in one embodiment the tree depth threshold is set to be n links greater than the number of links in the longest branch path of the new tree . n may be set to zero , 1 , or to a greater predetermined maximum value such as 6 , although other desirable values may be readily apparent to one skilled in the art . setting n to a larger value this will ensure room for growth and thus reduce the likelihood that the table will be rebuilt responsive to subsequent determination steps 312 . the worst case tree depth may also be set to a minimum value mv independent of the current longest chain value : this may be desirable to give more room to grow for a small table , yet apply a tighter control to a larger table as it approaches a critical search latency . if insertions are well distributed , the larger table will be able to support more incremental insertions , even with a smaller allowable change in tree depth . thus tighter control probably doesn &# 39 ; t mean that the table must be rebuilt more often . alternatively , the growth factor n may be responsive to table size . it is preferable that n be made smaller as a table gets larger , since a smaller table is more likely to insert on the longest branch and also requires more room to grow than a larger table . for example n may be set to 6 links greater than the number of links in the longest branch path of the new tree when a small table is built ( e . g . longest branch path has just 3 or 4 links ). then , each time the number of links in the longest branch increases , n is increased by a fraction of the increase in the longest branch . for example , if the longest branch increased by 2 , n might be increased by 1 , and further adjusted to insure n continues to be greater than the number of branches in the longest branch . note that in any case , n should be at least equal to one greater than the number of links in the longest branch . once the new table has been built by the control point at step 320 , the entire new table is transferred to the data plane table memory at step 322 . initially , the new table is in standby mode , and the old table continues to be used by the data plane for packet forwarding in order to avoid disruption of data plane packet forwarding . once the new table is in place ( as determined by down - load bandwidth of the system ), it is placed in active state and the old table is switched to standby . storage used by the old table can then be made available to support the next complete table swap . fig5 illustrates another algorithm embodiment 400 of the present invention . when a rule change request 402 is received by the control point , a type determination 404 is made as to whether an old rule is being removed or a new rule is being added . if an old rule is being removed , then an incremental delete command is passed directly to the data plane at step 406 , and an appropriate data plane resource removes the corresponding rule from the active table ; the algorithm 400 then ends at step 408 . alternatively , if a new rule is being added into the search structure as determined at step 404 , then a rule update count is incremented in step 410 to determine a total number of rule insertions since a last table rebuild in step 420 . if the new rule change in step 402 results in a total rule change count that exceeds a maximum value m , then a step 420 table rebuild is indicated . the table is rebuilt and the update count is accordingly reset to zero in step 420 , the new table is sent to the control plane in step 422 , and the process ends for this iteration in step 408 . m may be a predetermined fixed value . in some embodiments m may be dependent upon the table size : for example m may be set to equal 25 % of the number of entries in the table since the last time the table was rebuilt . where m is dependent upon table size , then m is also updated in step 420 responsive to the size of the new table built : thus each time the table is rebuilt , m is set to a value responsive to the number of total entries in the newly built table . it will be readily apparent to one skilled in the art that other percentage values may be chosen for m , or other table attributes may be selected to drive a function selecting the value of m , and the present invention is not to be construed as restricted to the embodiments described thus far . the embodiment of the invention described above maybe tangibly embodied in a in a computer program residing on a computer - readable medium or carrier 490 shown in fig5 . the medium 490 may comprise one or more of a fixed and / or removable data storage device such as a floppy disk or a cd - rom , or it may consist of some other type of data storage or data communications device . the computer program may be loaded into memory to configure a computer processor for execution . the computer program comprises instructions which , when read and executed by a processor causes the processor to perform the steps necessary to execute the steps or elements of the present invention . while preferred embodiments of the invention have been described herein , variations in the design may be made , and such variations may be apparent to those skilled in the art of computer network design and management , as well as to those skilled in other arts . the embodiments of the present invention identified above are by no means the only embodiments suitable for carrying out the present invention , and alternative embodiments will be readily apparent to one skilled in the art . the scope of the invention , therefore , is only to be limited by the following claims .