NETWORK SESSION DATA SHARING

In general, techniques for sharing of network session data are described. The techniques enable security devices (12B) to leverage application classification information in a federated manner. An example security device includes a memory and one or more processors. The processor(s) are configured to receive data representative of an application classification for a first packet flow (2) from a second security device (12A), to receive data of a second packet flow (4), and, when the second packet flow corresponds to the first packet flow, to monitor the data of the second packet flow based on the application classification for the first packet flow without determining an application classification for the second packet flow.