fig2 illustrates a simple network 10 to which several systems 14 are connected . in particular , the network 10 connects a user 14 a on one ethernet lan 12 a wit a remote server 14 b on a different ethernet lan 12 b , with a serial wan 16 using hdlc to connect the two lans 12 a , 12 b . two routers 15 a and 15 b provide the interfaces between the two types of networks . the ethernet lans 12 a , 12 b use ethernet protocol , while the serial wan 16 uses hdlc protocol . for a tcp packet to reach the server 14 b , the routers 15 a , 15 b must change the encapsulation from ethernet to hdlc , and then back to ethernet . these encapsulations are associated with and configured for each interface . local area network 12 a uses , for example , the protocol shown in block 18 a . here , http protocol is used by the application . tcp and ip protocols as well as ethernet protocol are used throughout the local area network . the same protocols are used in local area network 12 b as shown in block 18 b . the wide area network 16 , however , uses hdlc protocol instead of ethernet , as shown in block 18 c , because this protocol is better suited to wide area networks . therefore , it is necessary for the routers 15 a , 15 b to translate packets from the ethernet protocol to hdlc protocol and back to ethernet protocol . fig3 illustrates basic decapsulation and encapsulation as performed by router 15 a of fig2 . an incoming packet 20 a contains a message or other data 22 which is encapsulated with an http header 24 which in turn is encapsulated with a tcp header 26 . this in turn is encapsulated with an ip header 28 and the packet is finally encapsulated in an ethernet frame , including an ethernet header 30 . the router 15 a reformats and readdresses the packet by stripping off the ethernet header 30 , or decapsulating the frame , and reading the ip header 28 to obtain a destination address . the packet now appears as shown at 20 b . next the router prepends the packet with an hdlc header 32 as shown at 20 c . the router has thus encapsulated the message in a hdlc packet format . in practice , the decapsulation and encapsulation processes can be more complex , including compression , encryption and other functions . the present invention breaks these functions into individual elements , and dynamically chains the elements together at runtime , as needed , using a linked chain structure in one embodiment . for example , a chain can be dynamically built at the start of a session . each session can then have its own chain . a chain walker processes a packet by walking through a chain , passing the packet to each element in the chain , until either processing is completed , the chain is halted , or the process is dropped . each element also has the ability to “ punt ” the packet to an external software or hardware function , and the punted packet may be returned anywhere in the chain , or may not be returned at all . fig4 illustrates an embodiment of the present invention . the router shown 15 represents either router 15 a or 15 b of fig2 . while a typical router may have multiple interfaces , only two 51 , 53 are shown in fig4 . when a packet is received by the router 15 , it is passed to the chain walker 55 . the chain walker 55 in turn retrieves a pointer to a de - multiplexor , or demux , element . because in this example , interface 51 is an ethernet interface , the demux element 57 performs an ethernet decapsulation operation . for other types of interfaces , other decapsulation functions would be used in the demux chain . the demux operation or element 57 determines the protocol of the next higher level ( l3 ) used by the incoming packet , and passes the packet to an appropriate decapsulation chain . although it will be understood that there can be many more , four possible decapsulation chains are shown : an arp decapsulation chain comprising a single element arp_decaps 59 ; a sap decapsulation chain comprising a single element sap_decaps 61 ; a snap decapsulation chain comprising a single element snap_decaps 63 ; and a multi - element ip decapsulation chain 64 . of course , other decapsulation chains can exist for processing other protocols as well . for illustrative purposes , assume the packet uses internet protocol ( ip ). in this case , the demux element ether_decaps 57 returns a pointer to the first element 65 of the ip decapsulation chain 64 to the chain walker 55 , as indicated by dotted line 86 . logically , decrypt 65 follows ether_decaps 57 as indicated by solid arrow 85 . decrypt 65 is the first element in the ip decapsulation chain 64 . in this example , the decapsulation chain 64 is shown to comprise a decryption element 65 , a decompression element 67 , and an ip_switch element 69 . in an actual application , some or all of these elements may be absent , or additional elements may be in the chain . in actuality , for ip packets that are switched , there is no decapsulation , although the term “ decapsulation chain ” is retained . the ip_switch element 69 determines if the packet is to be switched or punted for further processing . for a tcp packet that is destined for the router itself , the actual decapsulation is performed in the ip process after the packet has been punted . similarly , the arp_decaps element 59 simply punts the packet to the arp process . as indicated by the dashed lines 79 , the process of chain walking can be implemented by having each chain element return to the chain walker 55 a pointer to the next chain element . the chain walker then calls the next element in the chain . after decapsulation , the router must prepare the packet for further transmission by encapsulating it in the desired protocol , assuming the packet is not intended for the router itself . dashed line 88 separates the decapsulation chain 64 from the encapsulation chain 74 . the packet is passed from the ip_switch element 69 to an encapsulation chain 74 associated with the intended output hdlc interface 53 , beginning with the ip_rewrite element 70 . ip_rewrite 70 performs functions such as updating ( decrementing ) the time - to - live count in an ip packet &# 39 ; s header , and recalculating the check sum for the ip header . the packet is then passed to the compression element 71 , the encryption element 73 and finally to an hdlc encapsulation element 77 . the encapsulation element 77 then passes the packet to the queue 81 for the intended output interface 53 . a scheduler 83 removes the packet from the queue 81 and transmits via the hdlc interface 53 . packets do not need to be switched in the de - encapsulation chain walk . rather , they can be handed to an outside process for further processing and then passed back to the start of the encapsulation chain . this is done for ‘ ping ’ packets that are destined for the router , for example . a chain walk can be stopped , started or resumed from any point on the chain . this allows elements such as an encryption element to pass the packet to an outside process , or piece of hardware , to perform the actual encryption . the processed packet may then be passed back to continue the chain walk . this mechanism is called ‘ punt ’ and ‘ puntback ’. the punting element hands the packet to the outside process or hardware . if the punting element wants the packet to resume the chain walk at the next element in the chain , it stores the chain next node pointer in the packet . the puntback routine starts the chain walk with the node previously stored in the packet . for example , as indicated by lines 87 , an element such as encryption element 73 can pass the packet to an encryption process 75 which is external to the chain . this is known as “ punting ” the process packet . the packet may be returned to the punting element , encryption element 73 in this example , after processing . alternatively , the chain walk could resume processing with any element in the chain . arp , sap and snap are various protocols which fall under the ip protocol family . as shown with respect to the arp , sap and snap decapsulation elements 59 , 61 and 63 respectively , packets may be processed by additional processes 60 , 62 , 66 external to the chains . packets processed by these functions 60 , 62 , 66 may then be queued directly at queue 81 without passing through an encapsulation chain . of course , while only ip , arp , sap and snap decapsulation chains are shown , additional protocols can also be supported for this interface 51 . each protocol would have its own decapsulation chain . note that although the incoming and outgoing interfaces are typically different interfaces , this is not always true . for example , ping and arp are protocols where the incoming and outgoing interface is typically the same interface . fig4 a illustrates an embodiment of the present invention having a virtual interface 90 , which has been inserted at the interface 88 ( fig4 ) between the incoming and outgoing chains . lines 88 a and 88 b represent the beginning and ending edges of the virtual interface 90 , respectively . message packets pass from the ip_switch element 69 to the ip_encaps element 91 within the virtual interface 90 . the ip_tunnel encaps element 91 encapsulates the ip packet into another ip packet , i . e ., it implements ip over ip , and passes the tunneled packet to an ip_switch element 69 a , which may or may not be the same as ip_switch 69 in the incoming chain . the encapsulated ip packet is then passed out of the virtual interface 90 across line 88 b to the encapsulation chain , specifically to the ip_rewrite element 70 . fig4 b illustrates chains which are more practical than those of fig4 which shows many elements for illustrative purposes . fig4 b shows two interfaces : serial 1 51 b and serial 2 53 b . the decaps chain encompasses a decryption element 65 b , a decompress element 67 b , a point to point protocol ( ppp ) decapsulation element 92 , and an ip switch element 69 b . the encapsulation chain comprises an ip_rewrite element 70 b , hdlc encapsulation element 77 b , and queue element 81 b , followed by a schedule element 83 b which passes the packet to the output serial port serail 2 53 b . fig4 c is a schematic diagram of an alternative embodiment of the present invention illustrating a non - sequential chain . in this example , the incoming interface is ethernet 1 51 c and the outgoing interface is serial 1 53 c . the decapsulation chain comprises an ethernet decapsulation module 57 c followed by ip_switch 69 c . ip_switch 69 c passes the packet to the encapsulation chain through the interface 88 , to ip_rewrite 70 c which , among other tasks , updates the time - to - live counter and updates the header checksum accordingly . the updated packet is then passed from ip_rewrite to a ppp encapsulation element 94 . the classifier element 95 then examines the packet , for example , for packet type or some other characteristic . for example , packets may be voice or data , as shown in fig4 c . in the case of voice , the packet is passed along path 96 a . voice data is compressed in this example by compression element 71 c - 1 . in the case of data , the packet is passed along path 96 b . in this example , the packet &# 39 ; s data is compressed by compression element 71 c - 2 , which may use a different compression scheme than the voice compression element 71 c - 1 . the packet is then encrypted by encryption element 73 c . packets from either path are then passed to queue element 81 c , and finally to the scheduler element 83 c which then outputs the packet through serial interface 53 c . of course , packets characteristics are not limited to just data and voice . these are simply offered as examples . packet characteristics on which the classifier 95 may base a decision , include but are not limited to , for example , protocol type , e . g ., ip , tcp , udp , html , arp , ftp , etc ., characteristics such as broadcast , multicast , unicast , etc ., tcp or udp port number , source and / or destination address , media type such as voice , data , or video . as with all other elements in the chain , the classifier 95 passes , to the chain walker 55 , a pointer to the next element . however , in one embodiment , the classifier 95 uses internal knowledge plus its analysis of the packet type to decide along which chain path 96 a , 96 b to send the packet . thus , the chain is not sequential , in that there are multiple branches a chain may take . fig4 d is a schematic diagram of another chain which can be implemented by a non - sequential embodiment . fig4 d shows just an encapsulation chain . a packet is received , from the incoming interface , or alternatively , from a virtual interface , by the ip_rewrite element 70 b . in the event ip_rewrite 70 b already knows how to encapsulate the packet , it performs the encapsulation , and there is no need to execute the hdlc encapsulation element 77 b . the encapsulation element 77 b is thus skipped by having the packet take the path 97 . in this case ip_rewrite 70 b passes back a pointer to the next element to be executed through path 97 a , the next element being the queue element 81 b . if ip_rewrite 70 b does not know how to encapsulate the packet , it will process the packet normally and return a pointer to hdlc encapsulation element 77 b to the chain walker 55 . finally , the packet is passed from queue element 81 b to the scheduler 83 b and transmitted out through the serial 2 port 53 b . the advantage of this , embodiment is that it cuts out the extra processing required to do an extra chain walk . often , ip_rewrite 70 b will know how to encapsulate a packet based on destination . this information may be returned , for example , by the hdlc encapsulation element 77 b after the first encapsulation of the packet . ip_rewrite 70 b can then store this information and use it for later packets with the same destination or within the session . there are other reasons for having non - sequential chains . for example , different types of encryption could be applied to packets depending on destination , type or some other attribute . furthermore , ip_rewrite can observe the congestion on the network and for example , skip right to the scheduler if there is no congestion . in very fast ethernet , for example , a router needs to get packets in and out fast . by allowing the chain elements to be skipped or executed in a non - sequential way , packets are routed through the router expediently . another example where non - sequential chains is useful is , for example , in implementing an access list or other filter . different chain elements can be executed depending on the destination and / or depending on access rights . the element which causes the non - sequential skip , such as the classifier 95 of fig4 c , can have internal data which allows it to determine , when a chain is built , what the jump targets are . determination may be based on data stored by or for the classifier 94 , and based on the incoming packet itself . more generally , different feature sets may be applied to packets depending on their source address , destination ip address , types or other attributes . the classifier element 95 can , for example , maintain this information in an internal data base and return , to the chain walker 55 , a pointer to the applicable element . fig5 illustrates the data structures used to implement sequential decapsulation and encapsulation chains , as well as the sequential portions of non - sequential chains . first , a separate interface descriptor block ( idb ) 100 is defined for each interface . each idb 100 includes several fields including a demux field 100 a , a decaps array pointer 100 b , an encaps array 100 c , queuing information 100 d and scheduling information 100 e . the demux pointer 100 a points to a demux element 102 . the demux element 102 is typically the only element in the demux chain . it is responsible for removing the outer encapsulation , e . g ., ethernet or hdlc , of an incoming packet , and for examining the packet to determine which protocol the packet uses . the decaps array pointer 100 b of the idb 100 points to a decaps array 104 . the decaps array 104 holds pointers 104 a - 104 d to the first elements of various decapsulation chains associated with the various protocols . for example , the first entry 104 a in the decaps array 104 is a pointer to the first element 106 of an ip decapsulation chain 103 . in one embodiment , each chain element has the structure shown at 106 . a next field 106 a points to the next element in the chain . a previous field 106 b points to the previous element in the chain , and is 0 or some other null indicator for the first element . furthermore , each chain element 106 contains a data processing element pointer 106 c and a control processing element pointer 106 d which point to the actual processing elements . control data 106 e may also be contained in the chain element 106 . a second chain element 107 is shown . the chain may contain a plurality of elements . each element returns a pointer to the next element to be executed to the chain walker . similarly , the encaps array pointer 100 c in the idb 100 points to an encaps array 108 . each entry in the encaps array 108 points to an encapsulation element for a specific protocol . for example , the first entry 108 a is a pointer to an ethernet encapsulation element . the next entries 108 b - 108 d contain pointers to encapsulation chain elements for other protocols , such as hdlc . fig6 is a flow chart 120 illustrating an embodiment of the present invention . first , at step 122 , a packet is received on an interface . then , at step 124 , an idb is retrieved which is associated with that interface . at step 126 , a pointer to the demux chain is retrieved from the idb , and passed to the chain walker . the chain walker 55 receives the packet and the pointer from the idb and sets a return code to 0 at step 130 . at step 132 the chain walker executes the current chain element pointed to by the pointer received from the idb . a typical chain element is shown at 134 . each element 134 on the chain processes the packet , and can return the next element to the chain walker or set the return code to 0 to stop the chain walk . the return code is set to a value less than 0 if , for some reason , the element 134 cannot process the packet , in which case the packet is to be dropped . otherwise , the chain element 134 returns to the chain walker a pointer to the next chain element . as described earlier in the description of fig4 a chain element 134 may punt or pass the packet to an external routine or to hardware 138 for further processing . the external routine or hardware 138 processes the packet , and may return control to the chain element , as shown . alternatively the external routine or hardware 138 may pass the packet to another chain or may halt the process . a code value is also used to notify the chain walker as to whether it should continue . if the packet was passed to a higher layer for further processing , the code is set to a value that tells the chain walker to do nothing more . if the packet is to be dropped , the code is set to a value that tells the chain walker to drop the packet . when the packet is returned to the chain walker , in step 140 the chain walker determines whether the return code is 0 . if not , either the packet is dropped at step 142 or the chain walker stops . if the return code is 0 , then at step 144 , the chain walker determines whether a chain element has been returned . if so the chain walker sets the current element to the next element at step 146 and returns to step 132 to execute the next chain element . this loop is repeated until either the packet is dropped or until there are no more chain elements . during initialization , the router &# 39 ; s hardware control software determines which network interfaces exist on the router . an idb 100 ( fig5 ) is created for each interface . the demux , decapsulation element and the encapsulation element fields are initially empty . a default demux element is associated with each interface based on the interface media type , e . g ., ethernet , hdlc , etc . configuration information is determined for each interface , for example , by reading it from a file or from a programmable memory . default queuing and scheduling elements are then added to the chain . finally , decapsulation and encapsulation elements are added to each interface according to the protocols available as determined by the configurations . once the chain for an interface is built , the interface is ready for packet processing . when a packet is received by an interface it is handed to the chain walker , as described with respect to fig4 . the chain walker has no knowledge of protocols . for an encapsulation of ip over ethernet , the chain might include only an ip decapsulation element , followed by an encapsulation chain comprising ethernet encapsulation , queuing and scheduling elements . chains can have elements added or deleted based on configuration . each element in a chain has no specific knowledge of the other elements on the chain . the chain walker has no knowledge of the number of elements or types of protocols on a chain . each element or node on the chain determines the whether or not the chain walk continues based on its processing of the packet . the above chain could thus be modified by inserting elements into the chains without changing the ethernet , ip , queuing or scheduling elements . for example , an ethernet address filter could be inserted before the ip decapsulation element , or a new compression element could be inserted at the beginning of the encapsulation chain . for packets entering the router from an interface , the chain walker typically starts with the demux element . while there can be any number of encapsulation and de - encapsulation elements chained together on an interface , there is typically only one demux element for each interface . for packets that are sourced on the router , the chain walk starts with the first encapsulation element . while this invention has been particularly shown and described with references to preferred embodiments thereof , it will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims .