flat is boring (and slow) first step to the new world order: split the state into state key and "rest" "key": the fields used to find a state key fields: family (ipv4/ipvcrap), protocol (tcp/udp/...), addresses, ports each key holds a queue of states, each state points to its key