The line module supports packet classification on ingress. A classification engine on the line module matches specific fields (such as source and destination IP address, source and destination port, and protocol), the ingress IP interface, layer 2 fields, or some combination of these against user-configured filters at wire speed.