Various embodiments relate to a method, network node, and non-transitory machine-readable storage medium including the following: receiving a packet; evaluating a flow processing table comprising a plurality of rules to determine whether a rule of the plurality of rules is applicable to the received packet, wherein: a rule of the plurality of rules includes a matching rule that identifies one or more flows to which the rule applies and at least one action that identifies at least one action to be taken when the rule applies; generating a new rule to be added to the flow processing table when the after failing to identify a rule of the plurality of rules as applicable to a received packet, including: evaluating at least one flow rule generation table to identify a first set of packet header fields and a set of processing actions; installing the new rule in the flow processing table.