3. The method of claim 1 wherein concurrently searching and retrieving comprises: issuing an expression as a query to the node; searching the second flow metadata of the second PCAP records stored in the first metadata repository to match the expression; in response to a match, using a second hash value retrieved from a matching second PCAP record to scan a second metadata repository to find a second entry matching the second hash value; and in response to finding a matching second entry, retrieving a second packet from the data repository.
3. The method of claim 1 wherein concurrently searching and retrieving comprises: issuing an expression as a query to the node; searching the second flow metadata of the second PCAP records stored in the first metadata repository to match the expression; in response to a match, using a second hash value retrieved from a matching second PCAP record to scan a second metadata repository to find a second entry matching the second hash value; and in response to finding a matching second entry, retrieving a second packet from the data repository. 5. The method of claim 3 wherein the expression is an extended Berkeley Packet Filter (BPF) expression and wherein searching the second flow metadata comprises extending BPF syntax to include abbreviations for the second flow metadata of the second PCAP records.