Methods and apparatus are provided for classifying data packets in a data processing device according to a set of processing rules, wherein, for each of a predetermined group of data items in each packet, each rule defines a rule range indicating a range of possible values of the corresponding data item for which that rule applies. The method comprises for each data packet: (a) performing a preliminary test for at least one data item in said group, the preliminary test comprising testing the value of the data item in the packet for a match with any of a predetermined set of frequently-occurring values for that data item, each frequently-occurring value being associated with a predetermined indicator, and, if a match is obtained, selecting for the data item the indicator associated with the matching frequently-occurring value; (b) performing an item search for any data item in the group for which no match is obtained in a preliminary test, the item search for a said data item comprising selecting a range identifier corresponding to the value of the data item from a predetermined set of range identifiers for that data item, the set of range identifiers indicating, for all possible values of the data item, which of the rule ranges corresponding to the data item in the rule set a value intersects, wherein the indicator associated with a said frequently occurring value for a data item is the range identifier corresponding to that value of the data item; and (c) identifying, based on the selected range identifiers for all data items in the group, at least one rule of any rules applicable to the data packet.