解决方案 Packet P arrives for flow F st probabilistic Forward P suspicion test Add co of p to head If alert. add f to table Queue of If F In Table, update state last N Suspicion packets table Report to manager periodically_Forensic or upon bad flow detection How to search memory for log all packets sent with flow ID F to add to forensic log? 问题:如何从队列中高效地找到属于可疑流的包? 问题：如何从队列中高效地找到属于可疑流的包？