A method comprising: receiving, by a first security device, layer 7, "L7", network data representative of application classification information and first peer information for a first packet flow from a second security device, wherein the L7 network data representative of the application classification information identifies an application that produced the first packet flow; storing, by the security device, the application classification information and the first peer information for the first packet flow, receiving, by the first security device, data packets of a second packet flow; determining, by the first security device, that the second packet flow is produced by the application that produced the first packet flow by comparing the stored first peer information of the first packet flow against second peer information of the second packet flow and determining a match between the second peer information of the second packet flow and the first peer information of the first packet flow, wherein each of the first peer information and the second peer information comprises layer 3, "L3", network data; and based on the second packet flow being produced by the application that produced the first packet flow, inferring the application classification information of the second packet flow, and inspecting, by the first security device, the data packets of the second packet flow based on the stored L7 network data representative of the application classification information for the first packet flow without determining separate application classification information for the second packet flow. receiving, by a first security device, layer 7, "L7", network data representative of application classification information and first peer information for a first packet flow from a second security device, wherein the L7 network data representative of the application classification information identifies an application that produced the first packet flow; storing, by the security device, the application classification information and the first peer information for the first packet flow, receiving, by the first security device, data packets of a second packet flow; determining, by the first security device, that the second packet flow is produced by the application that produced the first packet flow by comparing the stored first peer information of the first packet flow against second peer information of the second packet flow and determining a match between the second peer information of the second packet flow and the first peer information of the first packet flow, wherein each of the first peer information and the second peer information comprises layer 3, "L3", network data; and based on the second packet flow being produced by the application that produced the first packet flow, inferring the application classification information of the second packet flow, and inspecting, by the first security device, the data packets of the second packet flow based on the stored L7 network data representative of the application classification information for the first packet flow without determining separate application classification information for the second packet flow.