Series of packets identification capabilities

[ilyaglow]

Marking of a single packet is not enough sometimes to detect scanners like nmap and some types of attacks.

The badcapt should use some kind of caching mechanisms for a particular source IP-address to process through all packets the host sent.

Caching libraries to consider:

• https://github.com/bluele/gcache
• https://github.com/allegro/bigcache
• https://github.com/VictoriaMetrics/fastcache