Apparatus and methods for real-time traffic classification based on off-line determined traffic classification rules are provided. Traces of real traffic are obtained and subjected to statistical analysis. The statistical analysis identifies the multidimensional domain space of characteristic traffic parameters. Classification rules associated with the identified domains are derived and provided to traffic classification points for real-time traffic classification. Traffic classification points, typically edge network nodes, sample packets in aggregate streams with a predetermined probability. Statistical information regarding the sampled flows is tracked in a table, the number of time a flow was sampled providing a probabilistic measure of the flow's duration before the flow terminates. The table entries, which predominantly track high bandwidth flows, are subjected to the classification rules for real-time classification of the sampled flows. Optionally, rules include an action to be taken in respect of flows having characteristics matching thereof. Advantages are derived from low overhead on-line real-time classification of high-bandwidth flows at low overheads before flow termination.