
Document column headers in flow-print , ie Ts Fl.

ftfil/ftstat free.  are the definition, primitive, action names getting free()'d

time primitive to time-date and new time only primitive

tag -> tags (man pages not all the same)

pathnames in doc files should be run through configure

total_flows should always be a u_int64, not u_int32

DEC portability

fmt_ipv4_prefix is displaying 0 for 0.0.0.0/0

Robin's libcap/flow-import patch

flow-capture/flow-receive finish the locip/remip/port code to accept multiple
 exporters

the as substitution can be smarter, ie don't do substitution for multicast
traffic or output ifIndex 0, or possibly if the mask bits are 0.

mmap should be turned off for large files since it won't work.

flow-urpf

directio 

md5 checksums

ftio_write could use write() instead of writen() to better utilize d_buf
when write() returns 0 -- ie on a TCP connection.

flow-xlate - split overflow scaled flows

flow-bidir

flowstatd

flow-import/export - argus files

flow-import/export - OCxmon files

flow-import/export - netramet files

flow-import/export - cabletron files

flow-import/export - Cisco's flow collector

bgp integration - community (xxx:yyy) -> tag yyy

interface AS reports

interface prefix reports

prefix-AS in flow-stat
  src-src
  src-dst
  dst-src
  dst-dst
  src-dst-src-dst

libwrap support when wildcard src ip.

symbol names in import/export for mask

packet sampling rate need to be stored in the flow file.  flow-stat would
need to use this to estimate total # of flows

--with-cflow - automagically build Dave's Cflow module

Units in flow-stat summary output.

flow-capture may not be exiting cleanly when multiple instances are
running on the same directory.

flow-cat
  -R ifalias  Reset ifalias
  -R ifmap    Reset ifmap
  -L ifalias  Load ifalias
  -L ifmap    Load ifmap
  -S <path>   where to look for symbol names
  -I <iplist> only load for IP's

flow-capture
  -M <path>   where to look for symbol names

symbol file:
 ifmap exporter=1.2.3.4 ifIndex=99 name=FastEthernet0/0 encap=60 sample_rate=100
 ifalias exporter=1.2.3.4 name=outside ifIndex_list=5,1,2,3,4,5

flow-top

flow-capture ager is running on all errors

incorporate flow-sort

AC_ARG_WITH(socks,
[  --with-libwrap            use the libwrap library],
[AC_DEFINE(HAVE_LIBWRAP)])

autoconf/automake problems
 bins need installed

buffering around inflate() and deflate() might improve performance

instrument read/write for compression stats by using total_in and total_out

flow-5to8 - convert v5 to v8 flows

fix the tally code

why is flow-capture with -a and -e 86399 creating files every 10
seconds instead of every 5?

flow-active
 maintains active src or destination IP address first/last seen on disk
   first_time
   last_time
   flows
   octets
   packets

regression tests

flow-dns
 -l level (heirachy level, 0 is infinity)
  - level 1 would only be top level domains (.com, .edu, .net)
  - level 2 would be second level (ohio-state.edu, psu.edu, cic.net)
  - level 0 would be any level, ie FQDN's (shattered.net.ohio-state.edu)

flow-stat foreach summary:
  total flows,octets,packets,duration, and entries printed

flow-reduce
 various data reducations
 glue together TCP connections

keep state when there's a ftp control connection, then use that
to give hints about ftp data connections

