Computing systems, devices, and associated methods of operation of filtering packets at virtual switches implemented at hosts in a distributed computing system are disclosed herein. In one embodiment, a method includes receiving, at the virtual switch, a packet having a header and a payload and processing, at the virtual switch, the received packet based on multiple match action tables arranged in a hierarchy in which first and second layers individually contain one or more match action tables that individually contain one or more entries each containing a condition and a corresponding processing action.