Abstract: The ordinary packet filtering program used in an intrusion prevention system(IPS) consumes a tremendous amount of time and space that results in a larger packet loss rate and can not be achieved in parallel processing.This paper designs a new filtering program by adopting the shared-node counting bloom filter technology on the network device driver layer.The collision rate of the elements in bits group can be evidently decreased,and the free addition and deletion of dynamic filtering rules can be easily realized by improving the sets of hash functions.In each of the multi-rules sets,which is divided by tuple space,different shared-node counting Bloom filter bits groups are created.The search algorithm in tuple space is optimized and the collision rate of elements in bits group is further reduced.In the multi-core processors,filter processing can be executed in parallel through the establishment of a number of parallel processing threads.Experiment results show that the presented filtering program can reduce 28%~31% of the collision rate and 12%~19% of the hash table visits.