Patent ID: 7743166

Claim:
A method for transmitting data in an IP network comprising: receiving, by an appliance having a processing unit, a data transmission in the IP network; extracting a source address, a destination address, and at least one port from a header of the data transmission; looking up the source address and the destination address in an address mask table and determining a most granular bit-value mask by finding a longest prefix match corresponding to each of the source address and the destination address to obtain address result values, the address mask table having a plurality of bit-value masks wherein the plurality of bit-value masks have a plurality of granularities; looking up the at least one port in a port mask table to obtain port result values; forming a source and destination and port flow key based on the address result values and the port result values; looking up a flow key in the a source and destination and port flow key table to find a corresponding flow entry; and if the flow entry indicates to deny the data transmission, blocking the data transmission, otherwise transmitting the data transmission in the IP network with a service profile specified by the flow entry; if no bit-value mask in the address mask table corresponds to the source address or the destination address, no mask is applied to the source address or the destination address.