Device for enabling trap and trace of internet protocol communications

A network processing system for use in a network, the network consisting of multiple flows each flow formed by multiple data packets, the network processing system operable to intercept selected flows in the network and comprising:

• a learning state machines further comprising:
• a traffic flow processor processing the data packets to associate each data packet with a particular flow, to maintain state for each flow, and to compare one or more flows to a database of known signatures, the data base of known signatures including predetermined search criteria such that a match with the predetermined search criteria within the database of known signatures causes the network processing system to monitor the flow;
• a quality of service processor communicating with the traffic flow processor, the quality of service processor operable to assign the data packets into a quality of service queue corresponding to the associated flow.