In one embodiment, a method can include: (i) receiving a packet in a switch, where the packet includes a plurality of fields that forms a binding; (ii) performing a first lookup of a first table using a first lookup key, where the first lookup key includes a first subset of the plurality of fields; (iii) performing a second lookup of a second table using a second lookup key, where the second lookup key includes a result of the first lookup and a second subset of the plurality of fields; and (iv) indicating a check of the binding by using a result of the second lookup. The plurality of fields can include a media access control (MAC) source address, an internet protocol (IP) address, a receive port, and a receive virtual local area network (VLAN), while the result of the first lookup can include a layer-2 source index, for example.