Offloading network forensic analytics to programmable data plane switches