Supporting access control list rules that apply to TCP segments belonging to ‘established’ connection

A system, comprising:

• a processor, and
• a memory storing a program, which, when executed on the processor, performs an operation comprising:
• receiving a network frame;
• determining one or more set Transmission Control Protocol (TCP) flags of the received network frame;
• and
• upon determining that the one or more set TCP flags match a first entry in a numeric range table, updating bits of a search key that correspond to the first entry, and wherein the search key accesses a second entry stored in a Ternary Content Addressable Memory (TCAM), wherein the first entry further comprises (i) an encode field to scan a TCP header of the network frame for set TCP flags, (ii) a first mask field to a condition corresponding to unset TCP flags to identify in the network frame, (iii) a second mask field to a condition corresponding to set TCP flags to identify in the network frame, and (iv) an operation field specifying a disjunction operation for comparing the one or more set TCP flags in the network frame with the first mask field and the second mask field.

A computer program product, comprising:

• a computer-readable storage medium having computer-readable program code embodied therewith, the computer-readable program code configured to perform an operation, comprising:
• receiving a network frame;
• determining one or more set Transmission Control Protocol (TCP) flags of the received network frame;
• and
• upon determining that the one or more set TCP flags match a first entry in a numeric range table, updating bits of a search key that correspond to the first entry, wherein the search key accesses a second entry stored in a Ternary Content Addressable Memory (TCAM), and wherein the first entry further comprises (i) an encode field to scan a TCP header of the network frame for set TCP flags, (ii) a first mask field to a condition corresponding to unset TCP flags to identify in the network frame, (iii) a second mask field to a condition corresponding to set TCP flags to identify in the network frame, and (iv) an operation field specifying a disjunction operation for comparing the one or more set TCP flags in the network frame with the first mask field and the second mask field.