Network interface apparatus includes a host interface and a network interface, which receives packets in multiple packet flows destined for one or more virtual machines running on a host processor. Packet processing circuitry receives a first instruction from the host processor to offload preprocessing of the data packets in a specified flow in accordance with a specified rule, and initiates preprocessing of the data packets while writing one or more initial data packets from the specified flow to a temporary buffer. Upon subsequently receiving a second instruction to enable the specified rule, the initial data packets are delivered from the temporary buffer, after preprocessing by the packet processing circuitry, directly to a virtual machine to which the specified flow is destined, followed by preprocessing and delivery of subsequent data packets in the specified flow to the virtual machine.