struct qentry{
  int   expire  //based on LOCAL SYSTEM CLOK at packet receipt, not packet.stamp
  hash  hash    //packet hash
}

int ttl       = 900             //15min
int max_rate  = 10              //max 10packets/sec
int buf_size  = ttl*2*max_rate  //ttl*2 to account for local/remote clok diff.

//ordered by time of receipt, so that no sorting reqd when insert
fifo<type = qentry, length = buf_size> queue

//length here being usable length, actual bufer size == +~30%
hashtable<type = hash, length = buf_size> filter

intern_packet(packet p){
  t = now() 
  if(p.stamp < t-ttl ||
     p.stamp > t+ttl){
    return //stale (and posibly dupe)
  }
  
  h = hash(p)
  if(filter.lookup(h)){
    return //dupe
  }

  //assume worst case and always throw out after 30min from now
  queue.push(qentry(expire = t+ttl*2, hash = h))
  filter.insert(h)
}

run_every_watever(){
  t = now()

  while(!queue.empty()){
    //since sorted by time, only ever need to look at frontest element
    e = queue.front()

    if(t > e.expire){
      queue.pop()
      filter.delete(e.hash)
    }else{
      //stop as soon as reach first one not to be thrown out
      break
    }
  }
}