According to one embodiment, node addresses are efficiently detected. For example, a node address is extracted from a packet that is being communicated from a first network to a second network through a network element. An abstraction of the node address is determined. A determination is made as to any previously received packets correspond to the node address by comparing the abstraction to a plurality of abstractions that correspond to node addresses extracted from the plurality of previously received packets. The abstraction is added to the plurality of abstractions if the node address is not associated with any of the previously received packets.