1. A method performed by a network apparatus for classification, comprising: storing in a ternary content-addressable memory (TCAM) a plurality of classification rules comprising respective tags, each tag comprising a string of maskable bits, including an update bit; receiving and classifying data items according to the classification rules by extracting a respective key from each data item, appending an update-select bit to the extracted key, thereby constructing an extended key, and matching the extended key to one of the tags in the TCAM, wherein receiving the data items comprises receiving data packets from a network, and wherein extracting the respective key comprises extracting a string of bits from selected fields in the data packets, and wherein classifying the data items comprises looking up, responsively to a classification rule that contains the one of the tags that matched the extended key for each data packet received from the network, an action to be applied to the data packet, and applying the action to the data packet; in a default classification state, masking the update bit in all of the classification rules and setting the update-select bit in the extended key of all the received data items to a first bit value; and in response to an instruction to atomically replace a group of existing rules in the TCAM with new rules: in the group of the existing rules, unmasking the update bit, which is set to the first bit value; storing the new rules in the TCAM, with the update bit in the new rules set to a second bit value, different from the first bit value, and unmasked; and after storing the new rules in the TCAM, setting the update-select bit in the extended key of the received data items to the second bit value.