A method of identifying matching packets at different locations in a network, comprising: receiving, by a device, a first subset of a first plurality of packets, the first plurality of packets being associated with a first location in a network, and the first subset of the first plurality of packets being selected based on a filter; receiving, by the device, a second subset of a second plurality of packets, the second plurality of packets being associated with a second location in the network, the second location being different than the first location, and the second subset of the second plurality of packets being selected based on the filter; parsing, by the device, each packet in the first subset and the second subset to extract invariant header fields from an outermost internet protocol, IP header inwards, until a minimal set of invariant header fields is obtained (221, 231, 241, 251, 261, 271, 281) for each packet, that uniquely identifies each packet throughout the network, or until the minimal set of invariant header fields cannot be obtained for each packet, the minimal set of invariant header fields including a minimum set of invariant header fields, of each packet, that uniquely identifies each packet throughout the network within a particular time period, the particular time period being long enough in duration to allow each packet to traverse the network, but short enough in duration to prevent a same packet signature from being computed for different packets, the minimal set of invariant header fields not being obtainable for a particular packet with a particular protocol combination, and the particular protocol combination including no known identifier or sequence number that uniquely identifies the particular packet at the first location and the second location; computing, by the device, a packet signature from the minimal set of invariant header fields for each packet in the first subset and the second subset for which a minimal set of invariant header fields is obtained; and comparing, by the device, packet signatures associated with the first subset and packet signatures associated with the second subset to identify matching packets with a same packet signature in the first subset and the second subset. receiving, by a device, a first subset of a first plurality of packets, the first plurality of packets being associated with a first location in a network, and the first subset of the first plurality of packets being selected based on a filter; receiving, by the device, a second subset of a second plurality of packets, the second plurality of packets being associated with a second location in the network, the second location being different than the first location, and the second subset of the second plurality of packets being selected based on the filter; parsing, by the device, each packet in the first subset and the second subset to extract invariant header fields from an outermost internet protocol, IP header inwards, until a minimal set of invariant header fields is obtained (221, 231, 241, 251, 261, 271, 281) for each packet, that uniquely identifies each packet throughout the network, or until the minimal set of invariant header fields cannot be obtained for each packet, the minimal set of invariant header fields including a minimum set of invariant header fields, of each packet, that uniquely identifies each packet throughout the network within a particular time period, the particular time period being long enough in duration to allow each packet to traverse the network, but short enough in duration to prevent a same packet signature from being computed for different packets, the minimal set of invariant header fields not being obtainable for a particular packet with a particular protocol combination, and the particular protocol combination including no known identifier or sequence number that uniquely identifies the particular packet at the first location and the second location; computing, by the device, a packet signature from the minimal set of invariant header fields for each packet in the first subset and the second subset for which a minimal set of invariant header fields is obtained; and comparing, by the device, packet signatures associated with the first subset and packet signatures associated with the second subset to identify matching packets with a same packet signature in the first subset and the second subset.