Each processed packet is divided into layers which belong to a specific protocol. SL DC Engine parses each supported protocol and maps its fields, after which their values can be obtained via the API. In addition to, the DC Engine also maintains a hierarchy of fields to provide the ability to visualize a layer's structure in detail. After processing the packet, a user can obtain information about the state of each layer, and if errors occur during the dissection process, the DC Engine will report what exactly went wrong.

One of the main elements when monitoring a network is activity logging. The DLog module is responsible for collecting logs and allows the user to configure what data should be included in each log journal. The log may include data received from custom extensions. DLog also provides the ability to set policies for log rotation. In addition, the user can configure the count of processing threads according to the characteristics of their hardware, which will increase performance.

Classification tasks are common across many fields: information security, where data is sorted into malicious and benign; system administration, where faulty network operation is diagnosed; and mobile operators and internet providers, where flows are matched to popular internet services. SL DC Engine handles classification through a tagging mechanism. Users define any tag they need and describe the rule that assigns it to a packet or flow — tethering, fraud, or anything else their use case demands.