flow-cat
  -R ifalias  Reset ifalias
  -R ifmap    Reset ifmap
  -L ifalias  Load ifalias
  -L ifmap    Load ifmap
  -S <path>   where to look for symbol names
  -I <iplist> only load for IP's

flow-capture
  -M <path>   where to look for symbol names

flow-capture
  -S <srcip> source IP address to bind to

symbol file:
 ifmap 1.2.3.4 99  FastEthernet0/0 <optional encapsulation overhead>
 ifmap 1.2.3.4 100 Atm0/0/0
 ifalias 1.2.3.4 5 1 2 3 4 5 outside
 ifalias 1.2.3.4 5 6 7 8 9 10 inside

flow-top

flow-receive | flow-print then hit ^C.  flow-print gets the ^C and
 misses some output.  Who should be processing the interrupt?

flow-stat should be able to use masks in exports like -C

flow-capture ager is running on all errors

before release
  cflowd export format

flow-capture could be smarter and allow capturing multiple versions
to a single directory.

flow-export revived
 support cflowd format

incorporate flow-sort

incorporate flow-merge

update .pod files

AC_ARG_WITH(socks,
[  --with-libwrap            use the libwrap library],
[AC_DEFINE(HAVE_LIBWRAP)])

EXAMPLES

autoconf/automake problems
 doc directory
 #include <config.h>
 bins need installed

fix libwrap

move hash_ip*.c to chash.c - generic constant hash

buffering around inflate() and deflate() might improve performance

instrument read/write for compression stats by using total_in and total_out

flow-5to8 - convert v5 to v8 flows

The file expire code needs to understand a directory heirachy, ie
flow files for every day go into a directory.  update flow-cat to
understand directories too, ie flow-cat <dir> would recurse through dir

fix the tally code

fix the can't sort > 65535 entries problem

check hash_ip.c and make sure etime really shouldn't be updated at
3rd case

flow-print should be able to use asn symbol table

flow-capture should accept TCP connections and export the flows that way.
  XXX need to add secondary buffering

why is flow-capture with -a and -e 86399 creating files every 10
seconds instead of every 5?

src <-> dst interface matrix

ip_net_only should be a bit in the options var

OPT_* should be defined in one place

flow-stat should use internal sorting for hash tables

flow-active
 maintains active src or destination IP address first/last seen on disk
   first_time
   last_time
   flows
   octets
   packets

regression tests

flow-fanout 
  understand DNS names

the extended ip eval is ignoring lots of stuff

the "matches" addition should only happen if DEBUG2 is defined.

add a normalize call to pre condition the access lists so the additional
& is not needed in the eval

-E and others should accept an interface parameter in flow-filter

add IP range option for acl
 - use an extended access list with a different specifier, ie R instead of E

add options to flow-filter to look at next hop, ala -S or -D

packets and octets per flow should use hash tables at 65536
 to handle lookup table overflow

flow-filter
	filter flow pipeline
		read cisco access lists ie  flow-filter -f foo.confg -l 10
		-e flag to accomodate an access list on the command line
		-S to restrict start time
		-E to restrict end time

flow-dns
	-l level (heirachy level, 0 is infinity)
		- level 1 would only be top level domains (.com, .edu, .net)
		- level 2 would be second level (ohio-state.edu, psu.edu, cic.net)
		- level 0 would be any level, ie FQDN's (shattered.net.ohio-state.edu)

	foreach summary:
		total flows

flow-reduce
	various data reducations
		glue together TCP connections

flow-domains
	characterize flows into output files by a set of criteria,
	like an access list

keep state when there's a ftp control connection, then use that
to give hints about ftp data connections
