1. A method, comprising: receiving a packet having a plurality of fields in a header of the packet; defining at least one packet classification rule using a command-line interface (CLI), wherein the at least one packet classification rule comprises a structured part and an unstructured part, the structured part having a predetermined logical operator relation between at least two of the plurality of fields, the unstructured part having a user configurable relation among the plurality of fields; performing a first classification of the packet based on the structured part of the at least one packet classification rule; using the predetermined logical operator relation between the at least two of the plurality of fields for the structured part in the first classification to provide a first classification result; performing a second classification of the packet based on the unstructured part of the at least one packet classification rule and the first classification result; and using the user configurable relation among the plurality of fields with keywords identifying values in the plurality of fields for the unstructured part in the second classification, wherein the first and second classifications form a classification of the packet.