Some embodiments of the invention provide a method for offloading one or more data message processing services from a machine executing on a host computer. The method is performed at a virtual network interface card (VNIC) that executes on the host computer and is connected to the machine. The method receives, through a communications channel between the machine and the VNIC, (1) configuration data associated with processing data messages belonging to a particular data message flow associated with the machine, and (2) a set of service rules defined for the particular data message flow. The method determines that a first data message received at the VNIC belongs to the particular data message flow and matches at least one service rule in the set of service rules. The method performs, on the first data message, a service specified by the at least one service rule.