IPv6 would work the same way, because it is a finite space and the number of distinct ranges is low, because firewall rule tables are generally quite small (meg

IPv6 would work the same way, because it is a finite space and the number of distinct ranges is low, because firewall rule tables are generally quite small (megabytes!). The ranges are not some "noisy" set, but large blocks. Thinking about it, any tree-like data structure that includes a compression designed for handling long run-lengths would work just fine. For example, a minor variation of roaring bitmaps would suffice. However, another reply mentioned layer 7 firewalls, which can potentially understand DNS, HTTP headers, and apply regular expressions. Those would not be possible using this kind of naive data structure and would definitely require something like Z3.