System and method for monitoring logical network traffic flows using a ternary content addressable memory (TCAM). An exemplary embodiment can provide a network port that is associated with a TCAM. The TCAM can be configured with a plurality of entries, wherein each TCAM entry contains a value. Further, each TCAM entry can be associated with at least one network counter. A predefined set of values can be retrieved from at least one header field of a data packet processed by the network port. Each value in the predefined set of values can be aggregated into a search value, and the search value can be compared to the value contained in each TCAM entry. When a match is found between the search value and the value contained in a TCAM entry, each network counter associated with the matching TCAM entry can be incremented.