Flows are captured by stringing together filters as explained in
Section 2.2.
The packets received in a flow can be read by the application in
different ways. The simplest way is to read continuously from the
buffer whenever a packet is available, e.g., using the
filter_getnext_pkt() operation. Doing so, however, keeps the
application polling constantly. From a CPU usage and context switching
point of view, packets may be read more efficiently by blocking, e.g.,
until a certain number of packets has been received. FFPF offers two
flavours of blocking: (a) wait_for_n_pkts(n), a blocking call
that only returns after 
packets are received, and (b) installing a
filter_callback() which is non-blocking itself and results in a
callback of a registered callback function whenever packets are
received. At callback registration time, users specify how long the
callback should remain active. Of course, even with
filter_getnext_pkt() an application may block explicitly,
e.g. by calling sleep(10) to process every 10 seconds all
packets that were received in that period.