the present invention relates to a method and computer system device for applying a plurality of rules to data packets within a network computer system . a filter rule decision tree is updated by adding or deleting a rule . if deleting a filter rule then the decision tree is provided to a network data plane processor with an incremental delete of the filter rule . if adding a filter rule then either providing an incremental insertion of the filter rule to the decision tree or rebuilding the first decision tree into a second decision tree responsive to comparing a parameter to a threshold . in one embodiment the parameter and thresholds relate to depth values of the tree filter rule chained branches . in another the parameter and thresholds relate to a total count of rule additions since a building of the relevant tree .