1. A rules engine for the examination of selected fields in an addressed data packet, comprising: an access control list table containing entries each defining an access control list rule, a respective first action and a chain identifier; and an extension rule table for entries each defining an extension rule, a respective second action and a respective rule identifier wherein the rules engine is operative: (a) to search said access control list table to ascertain a match between an access control list rule and said addressed data packet; (b) to search said extension rule table to ascertain a match between an extension rule and said addressed data packet; in the event of a matched access control list rule matched to said addressed data packet, to prescribe one of: (ci) the respective second action associated with a matched extension rule in the event of correspondence between a chain identifier associated with the matched extension rule and a rule identifier identifying a match between that matched extension rule and said addressed data packet; or (cii) in the absence of said correspondence, the respective first action associated with said matched access control list rule.