Session aware adaptive packet filtering

A network device, comprising:

• a network port to receive a first plurality of packets and to receive an additional packet after the first plurality of packets are received, wherein the first plurality of packets are tapped from a network;
• one or more instrument ports through which to communicate with one or more network monitoring instruments and/or one or more media;
• a buffer to store the first plurality of packets as buffered packets;
• and
• a processing unit coupled to the network port and the one or more instrument ports, wherein the processing unit is configured for identifying a session to which the additional packet belongs, and retroactively processing at least some of the buffered packets based on the identified session.

A product having a non-transitory medium storing a set of instructions, an execution of which by a processing unit in a network device causes the network device to perform a method comprising:

• receiving a first plurality of packets at the network device, wherein the first plurality of packets are tapped from a network;
• storing the first plurality of packets in a buffer as buffered packets;
• receiving an additional packet by the network device after the first plurality of packets are received at the network device;
• identifying a session to which the additional packet belongs;
• and
• retroactively processing at least some of the buffered packets by the network device based on the identified session.