I see that there are different connection dictionaries for tcp, udp and icmp connections. These are indexed by originator/responder ip/port 4-tuple. Is there a specific reason (apart from performance maybe?) for going with this approach rather than creating a single dictionary indexed by a 5-tuple, 5th-tuple being the protocol? thanks -y