Yes I have been tying to think of an anaology. Array is the best term. Snort then uses a "pointer" to match items in the array. When a packet arrive snort navigates through the array depending on the protocol etc.