Move the new packet frequency check to a static utility, minor cleanups.

* Always use lag.
* Let the morepackets check decide how to treat "just look" events.
* Optimizations.
* Renames.