Patent ID: 8767551

Claim:
A method, comprising: in a system that processes communication packets, maintaining a list of active packet flows and respective actions that are specified for application to the packet flows, and a set of packet processing rules and a list of packet flows; based on the rules, defining respective actions for application to the packet flows; accepting a change in the packet processing rules; classifying an input packet into a packet flow from the list; verifying that a respective action applicable to the packet flow matches the packet processing rules only upon arrival of a first packet belonging to the packet flow following the change in the packet processing rules; applying the verified action to the input packet; classifying the input packets into the packet flows based on the processing rules, and applying to each input packet a respective action in accordance with the list; defining different respective time-out periods for different ones of the packet flows on the list; and upon detecting that no packet belonging to a given packet flow was accepted within a respective time-out period of the given packet flow, deleting the given packet flow from the list of the active flows.