1. A non-transitory storage device for correlating a network flow seen at a plurality of observation points in a network, the storage device comprising program instructions that, when executing, configure a first processing element at a first one of the plurality of observation points to perform: obtaining a first packet of the network flow; extracting one or more invariant fields from the first packet; sending a first address of the first packet and information of the one or more invariant fields of the first packet to a second processing element at a second one of the plurality of observation points, wherein the program instructions configure the first processing element to perform the extracting the one or more invariant fields of the first packet and the sending the first address in response to the first address being unknown, wherein the program instructions further configure the second processing element to perform: receiving the first address of the first packet and the information of the one or more invariant fields of the first packet; obtaining locally a second packet of the network flow; extracting one or more invariant fields from the second packet; comparing each of the one or more invariant fields received from the first processing element with a corresponding one of the one or more invariant fields obtained by the second processing element; determining a match between the first address of the first packet and a second address of the second packet based on a determination of the one or more invariant fields of the first packet being matched with the one or more invariant fields of the second packet within a predetermined percentage; and notifying the first processing element of the match between the first address of the first packet and the second address of the second packet, wherein the program instructions configure the second processing element to perform the extracting the one or more invariant fields of the second packet, the sending the second address, the comparing, and the determining the match, and the notifying, in response to the second address being unknown.