Patent ID: 7583670

Claim:
A method, comprising: receiving a signal from a user input device to define an access control list (ACL) in a network device, the ACL having an ACL entry that defines a configuration of transmission control protocol (TCP) flags; receiving a signal from the user input device to define a set indication for a first TCP flag in the ACL entry, wherein the defined set indication includes a ‘+’ sign prefixing the first TCP flag in the ACL entry; receiving a signal from the user input device to define a not-set indication for a second TCP flag in the ACL entry, wherein the defined not-set indication includes a ‘−’ sign prefixing the second TCP flag in the ACL entry; receiving a signal from the user input device to define a match all indication for the defined set and not-set indications in the ACL entry; receiving a packet in the network device, the packet having first and second fields associated therewith, the first field corresponding to the first TCP flag, the second field corresponding to the second TCP flag; and accepting the received packet in the network device if and only if the first field in the received packet is set and the second field in the received packet is not set.