1. A method for collecting network traffic data, the method implemented on a computer, the method comprising: deriving a protocol tree structure; generating a protocol identifier array from information derived from the protocol tree structure, wherein the protocol identifier array comprises storage for a plurality of levels, each level including one or more nodes each associated with a protocol identifier each node further comprising a protocol identifier corresponding to a parent node, wherein the protocol identifier array is a one-dimensional array and the protocol identifier of a node is an index to a location in the protocol identifier array containing the node, the generating performed by a processor of the computer; and storing the protocol identifier corresponding to a leaf node in the protocol identifier array in a data object associated with network traffic data for a network communication between two end points.