Timeline for 1.4 ship:


+ mfs + Document the refactored class hiearchy for one-page-report.
      + slg will look at before mfs begins refactoring

+ plot becomes abstract
  + pure virtual destructor (protected constructor too?)
  + concrete render(cairo_t, bounds_t)
  + pure virtual render_data(cairo_t, bounds_t)
    - This is called by render, which will calculate the bounds within the
      axes, labels etc.
    - sublcasses need only override render_data, plot() owns the space given
      to it
- time_histogram split into time_histogram and time_histogram_plot
  - time_histogram_plot is a concrete subclass of plot
    - contains pointer to const time_histogram and probably not too much else
  - time_histogram replaces dyn_time_histogram
    - time_histogram now contains a vector of maps and a const pointer to
      the best fit histogram (best fit map) which starts as the most granular
      histogram and is updated as histograms are dropped for overflow
    - implement [], size() directly on time_histogram to hide implementation
      and selection
- port_histogram and address_histogram are similarly split
- histogram_bar class is added
  - map (or fixed bucket uints?) values to counts
  - render(cairo_t, bounds_t, color_map) will fill region with a proportional
    bar by counts
- with a flexible enough histogram_bar class, time_histogram_plot,
  port_histogram_plot, and address_histogram_plot can be merged into
  templated histogram_plot concrete subclass of plot if desired
- packet intestion logic is moved to one_page_report; histograms are simply
  data structures
  - could create ingester class instead too




Features needed:
================
- Packet Grid
- Documentation (NPS Report)


What we are not doing:
======================
- Traffic Map
- Language identification
- Keyword extraction & clustering
- Passive DNS


Test Plan:
==========
- Performance testing

Packaging:
----------
- Put relevant boost headers in boost subdirectory

Compile testing:
----------------
Make sure that it compiles on these platforms:
- FC17
- Ubuntu
- OS10.6, 10.8
- cygwin
- mingw
- Centos 5.8
- Centos 6.0
- SUSE


Reliability testing:
--------------------
Test for crashing with all scanners on with specific data sets:
- no packets
- Lincoln Labs ID98 
   - One day
   - All of the packets concatenated together
- Lincoln Labs ID99 (All of the packets concatenated together)
   - One day
   - All of the packets concatenated together
- One day from ID98 & One day from ID99
- M57 Patents
  - One day
  - All packets concatenated together
- NGDC 2012 
  - All packets concatenated together

- Cada?

Correctness testing:
--------------------
Create a file of all MD5s of all TCP streams. Sort the file. Use "diff"

Data Sets for comparison:
- ID98 one day
- M57 one day

Compare results of:
- tcpflow 1.4 with tcpflow 1.0
- Question: Can Suricata provide the MD5 of tcp streams?



Packaging:
----------
- .tar.gz file distributed on digitalcorpora.
- windows executables on digitalcorpora
- downloadable tag from github


Announcements:
-------------



