The flow classification engine uses a decision tree to classify flows. At each node the protocol, src/dst port, or src/dst address of a flow is compared to some threshold.
This works well in case for protocols and ports because they are represented by single integer numbers. Comparison is cheap. In case of ip addresses comparison is expensive because a byte array representation of ip addresses is used for comparison. It would be much more performant to use an integer (for IPv4) or 2 longs (for IPv6) for representing ip addresses.
The ClassificationEngineBenchmark can be used to check classification performance.