Flows are grouped into flow classes, each of which is assigned flow class treatment rules, which might combine application of both firewall and QoS treatments. When a flow is identified as a member of a flow class, traffic for that flow can be treated according to treatment rules collectively with other flows assigned to that flow class. New flows not already members of an already-defined flow class are examined according to a set of flow class assignment rules, which have the effect of either identifying the proper flow class for that flow, or creating a new flow class for that new flow. For each flow, a first packet determines flow assignment, after which succeeding packets are treated according that flow. For each flow class, a first flow determines flow class assignment, after which succeeding flows are collectively treated according to that flow class.