A system and method for determining a source of an Internet protocol packet (IP). Generally, the system comprises a memory and a processor. The processor compares a destination address of the IP packet to a first destination address stored within a first destination address cell of the memory, and compares a destination port of the IP packet to a first destination port stored within a first destination port cell of the memory. The network processor also compares a source address of the IP packet to a first source address stored within a first source address cell of the memory, and compares a source port of the IP packet to a first source port stored within a first source port cell of the memory, wherein the stored first source address and the stored first source port are associated with the stored first destination address and the stored first destination port. The network processor also stores the source address and source port of the IP packet within the memory to determine the source of the IP packet if: the destination address and destination port of the IP packet match the stored first destination address and stored first destination port; the source address and source port of the IP packet do not match the stored first source address and stored first source port; and the stored first source address and stored first source port are universally accepted bits.