1. A machine-implemented method comprising: a) obtaining network packets; b) grouping the collected network packets into a plurality of flows; c) for each of the plurality of flows, i) determining a content characteristic by characterizing content of the flow using bit-stream level statistics, and ii) determining at least one of (A) content-independent flow characteristics, (B) port-independent flow characteristics, and (C) application header-independent flow characteristics; and d) enforcing a policy on at least one of the flows using both (1) the determined content characteristic and the (2) determined at least one of (A) content-independent flow characteristics, (B) port-independent flow characteristics, and (C) application header-independent flow characteristics, wherein the content characteristic is selected from a group of characteristics consisting of (A) packets of the flow include text content, (B) packets of the flow include bitmap content, (C) packets of the flow include wave content, (D) packets of the flow include zip content, (E) packets of the flow include JPEG content, (F) packets of the flow include MP3 content, (G) packets of the flow include encrypted content, and (H) packets of the flow include compiled machine instructions.