There is not "right" way to use MongoDB, only trade-offs. Let's take a simple example:
Option 1: Have everything in one document, and
$push packets into an array
Option 2: Make a new document for each packet. Have each one point to their 'parent' object.
1) When searching for a packet, Option 1 will return the entire document, and not tell you where in the array your packet is. Option 2 will return the specific packet.
2) Option 1 will fall over and die if you have too many packets (because of the 4MB limit on document size)
3) Option 1 is much faster if you always list all packets for a specific object. Option 2 requires many disk seeks to load all the packets. On modern hard drives, disk seeks are 100x slower than sequential disk reads.
4) Option 2 takes a little more disk space (because they all must link to their parent, instead of implicitly as in Option 1).
5) Option 2 has roughly constant write time, but Option 1 will have variable write time. In option 1, you are expanding an existing document when adding packets. Sometimes it won't fit and must be moved somewhere else. This can slow down the system. But if you're constantly adding packets to one document at a time, it will probably eventually be moved to the end where it can expand without being moved around, so that's slightly better.
The rule of thumb is: Always assume you will store everything in one document until you find a reason you need to break it up. But beware of the trade-offs each way.