1. A system for classifying packets based on packet content, the system comprising: a sequencer operable to receive packets and to identify packet flows; a content engine interfaced with the sequencer to receive packets and to search packet contents for predetermined expressions in a packet or in a packet flow; and a tag map interfaced with the content engine and operable to tag packets according to the predetermined expressions found by the content engine.