Flow based inspection packet snapshot ?

Hi,

While studying flow-based inspection, I read that FGT takes the snapshot of the packet ? I am confused that what is the snapshot of the packet ? and how the packet is processed using the flow-based inspection ? 

Because taking snapshot is taking the copy of the packet and the copy of the packet is buffered and the whole traffic stream needs to be captured to match against the signature so how this mode is efficient ?

What i read is that FGT takes the snapshot of the packet and compare it against the pre-existing signature database and held the last packet ? Now this approach may be valid for TCP because TCP always sends the connection termination request but UDP doesnt send the connection termination request so last packet may not be known, therefore in case of UDP how the FGT realize that this is the last packet in the stream ?