1. A method comprising: a) accepting network flows; b) for each flow, storing a summary of payload content of the flow using a summarizing function, wherein each summary stored is associated with flow attributes; c) accepting a query including a query parameter which includes at least an excerpt of payload content; d) determining a summary of the query parameter using the summarizing function; e) finding one or more summaries of payload content of the flows that match the summary of the query parameter, by searching the stored summaries of the payload content of the flows; and f) obtaining flow attributes associated with the found one or more summaries of content of the flows.