Atomic update of access control list rules

Abstract

There is disclosed in one example a network switching apparatus, including: a plurality ingress port; a plurality of egress ports; a ternary content addressable memory (TCAM) comprising a plurality of chunks, wherein the chunks can be atomically enabled or disabled; a switching circuit to switch traffic from the ingress port to a selected egress port according to an access control list (ACL) of the TCAM; and one or more non-transitory mediums having stored thereon instructions to atomically add or update two or more target rules, including: add the two or more target rules to one or more target-rule chunks; and atomically enable the target-rule chunks.

Dependencies are inferred from the claim text.