1. A memory device storing a data structure for tracking network behavior, comprising: a connection table that maps each node of a network to a record object that stores information about traffic to or from the node and between that node and others nodes in the network.