a match-action table
Picture a customs officer with a checklist. For each parcel, they look at certain labels (country of origin, declared value, contents) and follow the first matching rule: this combination goes through, that one is held, another is sent for inspection. A match-action table is exactly this checklist for packets. Each row says, in effect: if a packet's fields look like THIS, then DO THAT. The switch reads the relevant fields of an arriving packet, finds the row that matches, and performs the listed action.
Concretely, each entry has three parts: a match (a pattern over packet header fields, with wildcards allowed — for example destination IP in 10.0.0.0/8 and TCP port 80), a priority (so the most specific rule wins when several match), and a set of actions (forward out port 4, drop, rewrite the destination MAC, decrement TTL, send to the controller). Many rules also keep counters (packets and bytes matched) for monitoring. Tables are often chained into a pipeline: a packet matches in table 0, which may send it to table 1 for further processing, and so on. This match-then-act model is what OpenFlow exposes and what real switch hardware (and programmable data planes) implement.
Why it matters: the match-action table is the heart of how a modern, SDN-style network forwards. Instead of each box running a distributed routing protocol and deciding for itself, a controller fills these tables with rules and the switch just executes them — fast, in hardware. It is general enough to express routing, switching, firewalling, load balancing, and NAT all in the same framework. The honest constraint is capacity and expressiveness: hardware tables hold a limited number of entries (especially the fast TCAM ones), and a plain match-action table only matches the fields it was built to understand, which is part of why programmable parsers and P4 exist.
A switch holds these entries, highest priority first: (1) match dst-IP 10.0.5.7, action forward port 2; (2) match dst-IP 10.0.0.0/8, action forward port 5; (3) match anything, action send-to-controller. A packet for 10.0.5.7 matches rule 1 and leaves on port 2. A packet for 10.0.9.3 falls through to rule 2 and leaves on port 5. A packet for 8.8.8.8 matches only rule 3 and is escalated to the controller.
Priority decides the winner when several rows match; specificity usually means higher priority.
A match-action table is more general than a traditional forwarding table: the latter matches only destination addresses, while match-action rules can match many fields at once and apply rich actions, so the same table can do routing, filtering, and rewriting together.