IP networks carry packets that consist of headers and payloads. Typical traffic analysis systems at layer 3 process packet headers in order to obtain as much information about the traffic as possible. However, performing of deep packet analysis requires the processing of packet payloads as well. Another important requirement of layer 3 processing is the need to process the payloads at wire speeds. A system and method for deep packet inspection at layer 3 involves (a) an approach for packet payload processing; (b) accounting for out of order arrival of packets; (c) an approach for partial match analysis so as to be able to analyze the traffic flows when only partial information is available; and (d) an approach for effective payload processing for attempting to achieve wire speed processing.