According to at least one aspect of the present disclosure, a method for grouping constituent flows of a multiplexed or tunneled flow is provided. The method comprises receiving one or more packets of the multiplexed flow; responsive to receiving the one or more packets, determining one or more attributes of the one or more packets of the multiplexed flow; determining, based on the one or more attributes, a predicted state of a next packet of the multiplexed flow; receiving the next packet; responsive to receiving the next packet, determining whether the next packet has an observed state that is similar to the predicted state; and responsive to determining that the observed state is similar to the predicted state, grouping the packet with the constituent flow.