Packets are received from a network, and for each received packet, it is determined whether the packet belongs to one of a plurality of previously identified flows using a plurality of existing flow rules. For each received packet determined to belong to one of the previously identified flows, a flow identifier is assigned to the packet to indicate the previously identified flow to which the packet belongs and the packet or a packet descriptor corresponding to the packet is directed to a next location in a packet forwarding pipeline. Additionally, for each received packet determined not to belong to one of the previously identified flows, it is determined whether the packet belongs to a currently unknown flow. If a received packet is determined to belong to a currently unknown flow: the packet is sent to a processing unit associated with the packet forwarding pipeline; the packet is analyzed using the processing unit; an additional existing flow rule corresponding to the packet is determined using the processing unit; and based on the analysis of the packet; and the additional existing flow rule is added to the plurality of existing flow rules.