A network device has a packet input unit, a checking unit, and a discovery unit. The packet input unit is configured to receive ingress packets. The checking unit is configured to determine whether identifying characteristics of received ingress packets match stored identifying characteristics of a packet flow that is stored in a memory, to perform a network action when the identifying characteristic of the received ingress packet matches the stored identifying characteristic. The discovery unit is configured to intercept an egress packet received from the control plane processor, the egress packet corresponding to the received ingress packet, to determine one or more differences in selected portions of a header portion of the received ingress packet resulting from processing at the control plane processor, and to store in the memory a new network action based on the one or more differences.