A network device including a port, a packet classifier, and a processor. The port is configured to communicate with a network. The packet classifier is configured to select a plurality of packets according to a packet classification rule. The packet classification rule describes a packet characteristic. The processor is configured to execute a program. The program is configured to perform comparisons between (i) a portion of each of the selected packets and (ii) one or more predetermined patterns. One of the predetermined patterns is added to the program without having to reboot the network device.