A system includes an information storage module and an inspection module. The information storage module is configured to store a plurality of tags. Each tag is associated with a known set of traffic types of a plurality of known sets of traffic types. The inspection module is configured to compare a traffic flow to a set of traffic types to determine a matching set of traffic types, request a tag from the information storage module, and mark the traffic flow with the tag. The tag corresponds to the matching set of traffic types.