A system, method, and non-transitory computer-readable medium for filtering flow table entries is described. A trusted device may send a table read request to a network interface controller (NIC) that includes predicate logic. The NIC will use the received predicate logic to filter flow table entries. The entries that satisfy the criteria specified by the trusted software are moved to a Direct Memory Access (DMA) buffer on the NIC to create a subset of entries. Once some or all of the flow table has been scanned, the subset of entries may be transferred from the DMA buffer on the NIC to a memory of the trusted host via a DMA transfer to be further processed by the trusted host.