Systems and methods of network monitoring are disclosed. One exemplary method includes receiving a first packet, creating a filter instance if the first received packet matches a filter template, receiving a second packet, and storing the second received packet if the second received packet matches the created filter instance. The filter instance is based at least partially on the filter template. An exemplary system includes a network interface, a memory, and a processor. The memory stores program code which programs the network monitor device to receive a first packet, create a filter instance if the first received packet matches a filter template, receive a second packet, and store the second received packet if the second received packet matches the created filter instance. The filter instance is based at least partially on the filter template.