A method for inspecting a data packet in a computer network, the data packet having associated header data and content, the method comprising the steps of: receiving (302; 400) a data packet; examining (304; 405; 410) the data packet to classify the data packet based on the header and the application layer content of the packet, and performing content based specialized processing based on the result of the classification including at least one of content based protocol decoding, content based object extraction, or content based pattern matching to determine whether to allow the data packet to pass; where the examining and processing comprises: determining whether the data packet is associated with a data flow that is known from existing flow records and whether the flow has been previously classified; in the event that the data flow is known and has been classified: performing the specialized processing in the event that the data flow is unknown and has not been classified: associating a new session to the received data packet; determining whether the received data packet should be allowed based on the header of the data packet; and in response to a determination that the received data packet should be allowed: creating a new flow record; classifying the data packet based on the header and the content and performing the specialized processing; and in the event that the data flow is known and has not been classified: classifying (420; 425) the data packet based on the header and the content and based on packets previously stored and associated to the flow and performing the specialized processing. receiving (302; 400) a data packet; examining (304; 405; 410) the data packet to classify the data packet based on the header and the application layer content of the packet, and performing content based specialized processing based on the result of the classification including at least one of content based protocol decoding, content based object extraction, or content based pattern matching to determine whether to allow the data packet to pass; where the examining and processing comprises: determining whether the data packet is associated with a data flow that is known from existing flow records and whether the flow has been previously classified; in the event that the data flow is known and has been classified: performing the specialized processing in the event that the data flow is unknown and has not been classified: associating a new session to the received data packet; determining whether the received data packet should be allowed based on the header of the data packet; and in response to a determination that the received data packet should be allowed: creating a new flow record; classifying the data packet based on the header and the content and performing the specialized processing; and in the event that the data flow is known and has not been classified: classifying (420; 425) the data packet based on the header and the content and based on packets previously stored and associated to the flow and performing the specialized processing. determining whether the data packet is associated with a data flow that is known from existing flow records and whether the flow has been previously classified; in the event that the data flow is known and has been classified: performing the specialized processing in the event that the data flow is unknown and has not been classified: associating a new session to the received data packet; determining whether the received data packet should be allowed based on the header of the data packet; and in response to a determination that the received data packet should be allowed: creating a new flow record; classifying the data packet based on the header and the content and performing the specialized processing; and performing the specialized processing in the event that the data flow is unknown and has not been classified: associating a new session to the received data packet; determining whether the received data packet should be allowed based on the header of the data packet; and in response to a determination that the received data packet should be allowed: creating a new flow record; classifying the data packet based on the header and the content and performing the specialized processing; and in the event that the data flow is known and has not been classified: classifying (420; 425) the data packet based on the header and the content and based on packets previously stored and associated to the flow and performing the specialized processing.