Usually lpm tries are used for this. Firewalls use something like the longest prefix match algorithm behind the scenes, which means that rules for e.g. the sam

Usually lpm tries are used for this. Firewalls use something like the longest prefix match algorithm behind the scenes, which means that rules for e.g. the same IPs (subnets) with a longer prefix are prioritized higher when being queried. Of course that also requires a default rule for 0.0.0.0/0 to avoid an invalid result. [1] https://docs.kernel.org/bpf/map_lpm_trie.html https://docs.kernel.org/bpf/map_lpm_trie.html [2] https://blog.apnic.net/2023/01/10/longest-prefix-matching-in-networking-chips/ https://blog.apnic.net/2023/01/10/longest-prefix-matching-in...