A network switch is disclosed. The network switch includes an input port and an output port. The network switch further includes a rule logic and a memory for storing a configurable counter. The rule logic is configured to inspect a packet received via the input port and attempt to find a rule for the packet and if the rule is found, to reset the counter and process the packet according to a preconfigured follow up action associated with the rule and if the rule is not found, to route the packet according to a default rule. The rule logic is configured to identify the packet for a follow up action based at least on a subset of content of the packet including a header and a payload of the packet. The counter may hold a time value or the number of packets from a same source to a same destination, a number of bytes received from the same source to a same destination, or a user configurable parameter to control the rule validity period.