input wire format from disk

SCTP support

NetFlow v9 support

flow-rptfmt

Sparc/Linux portability

flow-tag should be able to reference a ftfil filter
flow-tag match-all action

flow-capture - use ftfil ACL for accepting flows.

flow-split should fail more gracefully when splitting on time with old
flow files without clocking information.

source address spoofing with flow-send/flow-fanout

flow-cat -> ftlib so flow-xxx /flows/data/2002 will work without using flow-cat

flow-probe

flow-capture / flow-expire not removing empty directories.

flow-exire should not accept -E47 Gig

flow-report per src/dst tag src/dst host count

reference ip2hostname utility on web page

flow-report, flow-nfilter, flow-tag - config file from command line string.

flow-print strftime style processing.

flow-cat mmap causes crash problem on Solaris

cisco magic filters

total_flows should always be a u_int64, not u_int32

DEC portability
 - check for snprintf

Robin's libcap/flow-import patch

flow-capture/flow-receive finish the locip/remip/port code to accept multiple
 exporters

the as substitution can be smarter, ie don't do substitution for multicast
traffic or output ifIndex 0, or possibly if the mask bits are 0.

mmap should be turned off for large files since it won't work.

flow-urpf

directio 

md5 checksums

ftio_write could use write() instead of writen() to better utilize d_buf
when write() returns 0 -- ie on a TCP connection.

flow-xlate - split overflow scaled flows

flow-bidir

flow-import/export - argus files

flow-import/export - OCxmon files

flow-import/export - netramet files

flow-import/export - cabletron files

bgp integration - community (xxx:yyy) -> tag yyy

libwrap support when wildcard src ip.

packet sampling rate need to be stored in the flow file.  flow-stat would
need to use this to estimate total # of flows

--with-cflow - automagically build Dave's Cflow module

flow-capture may not be exiting cleanly when multiple instances are
running on the same directory.

flow-cat
  -R ifalias  Reset ifalias
  -R ifmap    Reset ifmap
  -L ifalias  Load ifalias
  -L ifmap    Load ifmap
  -S <path>   where to look for symbol names
  -I <iplist> only load for IP's

flow-capture
  -M <path>   where to look for symbol names

symbol file:
 ifmap exporter=1.2.3.4 ifIndex=99 name=FastEthernet0/0 encap=60 sample_rate=100
 ifalias exporter=1.2.3.4 name=outside ifIndex_list=5,1,2,3,4,5

flow-top

flow-capture ager is running on all errors

incorporate flow-sort

AC_ARG_WITH(socks,
[  --with-libwrap            use the libwrap library],
[AC_DEFINE(HAVE_LIBWRAP)])

buffering around inflate() and deflate() might improve performance

instrument read/write for compression stats by using total_in and total_out

flow-5to8 - convert v5 to v8 flows

flow-active
 maintains active src or destination IP address first/last seen on disk
   first_time
   last_time
   flows
   octets
   packets

regression tests

flow-dns
 -l level (heirachy level, 0 is infinity)
  - level 1 would only be top level domains (.com, .edu, .net)
  - level 2 would be second level (ohio-state.edu, psu.edu, cic.net)
  - level 0 would be any level, ie FQDN's (shattered.net.ohio-state.edu)

flow-reduce
 various data reducations
 glue together TCP connections

keep state when there's a ftp control connection, then use that
to give hints about ftp data connections

