One embodiment disclosed relates to a method of sampling network traffic. A data packet is received by a network device. Information is extracted from fields in the data packet, and a look-up word is created using the extracted information. A content addressable memory is searched for entries matching the look-up word. If a match is found, then a sampling circuit is queried, and a response is received therefrom. The data packet may be sent to a destination port. In addition, if the response from the sampling circuit indicates that the data packet is chosen to be mirrored, then the data packet may be also sent to a mirror port. Other embodiments are also disclosed.