Traditional methods either involve the reconstruction of complete application-layer packets, and performing allow/deny decisions based on analysis thereof, or reassembly to just the transport layer (e.g., TCP or UDP) and performing allow/deny decisions based on port numbers and other network address information, according to a predefined security policy.