2007-03-08 00:08  Brian Trammell <bht@cert.org>

	* [r6585] Doxyfile,
	  Makefile.am, configure.in, doc/Makefile.am,
	  include/Makefile.am, include/naf/aggregate.h,
	  include/naf/autoinc.h, include/naf/dynflow.h,
	  include/naf/exparse.h, include/naf/filter.h,
	  include/naf/lexcore.h, include/naf/match.h,
	  include/naf/nafcore.h, include/naf/sort.h, libnaf.pc.in,
	  naf.spec, naf.xcodeproj, src/Makefile.am, src/aggregate.c,
	  src/drv_argus.c, src/drv_argus.h, src/drv_renaf.c,
	  src/drv_renaf.h, src/drv_silk.c, src/drv_silk.h, src/dynflow.c,
	  src/exparse.c, src/filter.c, src/lexcore.c, src/match.c,
	  src/nafalize.c, src/nafalize.h, src/nafcore.c, src/nafilter.c,
	  src/nafload.c, src/nafscii.c, src/nafz_indrv.c,
	  src/nafz_indrv.h, src/nafz_inipfix.c, src/nafz_inipfix.h,
	  src/nafz_inpcap.c, src/nafz_inpcap.h, src/nafz_iocom.c,
	  src/nafz_iocom.h, src/nafz_outfile.c, src/nafz_outfile.h,
	  src/sort.c:
      Merged fixbuf 0.6.0 refactor branch back on to trunk. This completely
	  changes 1. how fixbuf works, 2. the APIs for libnaf and libyaf,
	  and 3. the wire/disk representation for bidirectional flow data (to
	  actually comply with draft-ietf-ipfix-biflow-03).
	  
	  This merge builds and the full yaf/naf/skipfix/rwio path appears to
	  work in preliminary testing. The rest of this week is prepping the
	  trunk for the 0.6.0 release.

2006-10-05 17:06  Tony Cebzanov <tonyc@cert.org>

	* [r5257] naf.spec: Fix specfile for new location of HTML docs.

2006-10-04 18:14  Brian Trammell <bht@cert.org>

	* [r5219] src/Makefile.am: add missing nafalize.h to autotools

2006-10-04 17:09  Brian Trammell <bht@cert.org>

	* [r5218] include/naf/autoinc.h, src/aggregate.c, src/nafcore.c,
	  src/nafz_inpcap.c: warning fixes

2006-10-04 15:24  Tony Cebzanov <tonyc@cert.org>

	* [r5205] README, naf.spec: Added YAF specfile.
	  Fixed package naming inconsistencies, particularly ones involving 
      libraries. Changed all AirCERT references to NetSA.
	  Changed aircert.sourceforge.net links to tools.netsa.cert.org
	  where appropriate. Fixed a few specfile typos.
	  Changed glib references to glib2.

2006-10-03 19:02  Brian Trammell <bht@cert.org>

	* [r5188] trunk/naf/NAFSuite.xcodeproj/project.pbxproj,
	  trunk/naf/fixbuf/libfixbuf.spec, naf.spec: specfile tweaks.

2006-10-03 17:49  Brian Trammell <bht@cert.org>

	* [r5184] include/naf/nafcore.h: Doc cascade - make sure everyone
	  knows error descriptors on anything that cascades down to fixbuf 
      are not optional.

2006-09-28 19:00  Brian Trammell <bht@cert.org>

	* [r5083] src/aggregate.c, src/drv_argus.c, src/drv_renaf.c,
	  src/nafalize.c, src/nafcore.c, src/nafilter.c, src/nafz_indrv.c,
	  src/nafz_inipfix.c, src/nafz_inpcap.c, src/nafz_iocom.c,
	  src/nafz_outfile.c: --Wmost --Werror fixes.

2006-09-28 17:35  Brian Trammell <bht@cert.org>

	* [r5080] src/nafcore.c: fix spurious assert that causes read
	  failures on 64-bit machines.

2006-09-22 19:17  Brian Trammell <bht@cert.org>

	* [r4979] src/nafalize.c, src/nafcore.c, src/nafz_inipfix.c:
	  Continue to track fixbuf 0.5.0 API changes.

2006-09-20 19:48  Brian Trammell <bht@cert.org>

	* [r4938] src/nafalize.c, src/nafilter.c, src/nafload.c,
	  src/nafscii.c: Track Airframe 0.6.5 api changes

2006-09-19 20:59  Brian Trammell <bht@cert.org>

	* [r4910] NEWS, configure.in, src/Makefile.am, src/nafalize.c,
	  src/nafz_inpcap.c, src/nafz_inpcap.h: Prep for 0.5.5 release.
	  Refactor packet and fragment handling to use libyafrag to do 
      pcap decode. Change configure.in to make pcap support
	  optional.

2006-09-18 20:25  Brian Trammell <bht@cert.org>

	* [r4891] src/nafalize.c: default to ipfix input type (for reading
	  YAF files).

2006-09-13 21:20  Brian Trammell <bht@cert.org>

	* [r4862] src/nafz_inipfix.c: track changes in tcp transport layer
	  api for fixbuf.

2006-09-08 19:57  Brian Trammell <bht@cert.org>

	* [r4793] src/Makefile.am: tweak Makefile to fix header include
	  order bug.

2006-08-30 14:42  Brian Trammell <bht@cert.org>

	* [r4730] src/nafz_inipfix.c: fixbuf API change tracking.

2006-08-29 19:48  Brian Trammell <bht@cert.org>

	* [r4716] trunk/naf/NAFSuite.xcodeproj/project.pbxproj,
	  trunk/naf/airframe/libairframe.pc.in,
	  trunk/naf/fixbuf/libfixbuf.pc.in, configure.in, libnaf.pc.in,
	  trunk/naf/yaf/libyaf.pc.in, trunk/naf/yaf/libyafrag.pc.in: fix
	  pkg-config to actually include glib dependencies. add
	  libnaf.pc. xcode project evolution.

2006-08-22 17:48  Brian Trammell <bht@cert.org>

	* [r4592] doc/Makefile.am, src/nafz_inpcap.c: Typofix; continued
	  attempts at makefile hacking for automatic doc
	  generation (didn't work, bah...)

2006-08-22 15:26  Brian Trammell <bht@cert.org>

	* [r4591] doc/nafalize.pod, src/nafz_inpcap.c: Point out that NAF
	  pcap input sucks compared to YAF in the nafalize
	  POD, and that you really should be pre-YAFfing stuff now (NAF
	  pcap was
	  originally intended to be for demonstration purposes and ad-hoc
	  forensic summaries, anyway).
	  
	  Fix NAF pcap input to not read past truncated packet header
	  boundaries, as in YAF.
      
2006-08-22 13:51  Brian Trammell <bht@cert.org>

	* [r4583] src/nafcore.c, src/nafz_inipfix.c, src/nafz_inipfix.h,
	  src/nafz_inpcap.c: Port NAF to new fixbuf API. Build checkpoint.
	  Need this for end-to-end DAG testing on hair, and for performance 
      testing for the LISA paper.

2006-08-15 15:38  Brian Trammell <bht@cert.org>

	* [r4496] include/naf/filter.h, src/filter.c: rangelist coalesce
	  is not used externally, so remove it from the API.

2006-07-31 20:31  Brian Trammell <bht@cert.org>

	* [r4386] src/nafcore.c: Tracking writer API changes.

2006-07-27 21:24  Brian Trammell <bht@cert.org>

	* [r4378] src/sort.c: Rewrite comparator. I'm not precisely sure
	  _why_ this was smashing memory but it was. Sorting works now. 
      Most of this commit actually
	  involves removal of good old fashioned printf() debugging.

2006-07-27 19:40  Brian Trammell <bht@cert.org>

	* [r4376] src/sort.c: Incremental debug checkin. There is still a
	  memory corruption bug here; however, compare now checks every
      argument against the full array and rejects non-present elements. 
      Debugging continues.

2006-07-27 16:02  Brian Trammell <bht@cert.org>

	* [r4375] include/naf/sort.h, src/sort.c: Sort refactor refactor -
	  move to using pointer arrays for efficiency.
	  Discovered that the comparator gets called with a pointer to the
	  pointer, not the stored pointer itself. It would be really neat
	  if this had been clearly documented. But oh well.
	  
	  There still seems to be some issue with a comparison against a null
	  flow in the array that I didn't add. Will work around after lunch,
	  just _finally_ got to something that doesn't blow up
	  gratuitously and wanted to save my day.

2006-07-26 18:46  Brian Trammell <bht@cert.org>

	* [r4365] include/naf/sort.h, src/exparse.c, src/sort.c: Sort
	  refactor build checkpoint. While debugging sorting (which I'm
	  still not certain is working, still testing), discovered that the sort
	  internals, based as they were on trees from the old sort-everything
	  NAF days, were not especially efficient. Replace running
	  sort-and-rebalance with single array quicksort.
	  
	  Add sort descriptor dump to --check-syntax.
	  
	  Still testing.

2006-07-25 20:16  Brian Trammell <bht@cert.org>

	* [r4361] configure.in, src/nafcore.c, src/nafz_inipfix.c: Changes
	  for fixbuf 0.5.0 template API.

2006-07-20 18:55  Brian Trammell <bht@cert.org>

	* [r4325] Doxyfile, configure.in, include/Makefile.am,
	  src/Makefile.am, src/aggregate.c: Library refactor code and
	  autoconf build system changes complete. It's
	  all over but the doxidation.

2006-07-20 18:15  Brian Trammell <bht@cert.org>

	* [r4320] include/naf/aggregate.h, include/naf/exparse.h,
	  include/naf/match.h, include/naf/nafcore.h, src/aggregate.c,
	  src/aggregate.h, src/exparse.c, src/exparse.h, src/match.c,
	  src/match.h, src/nafalize.c, src/nafalize.h: XCode build
	  checkpoint for nafalize library refactor. Move match and
	  aggregate functions into libnaf.

2006-07-20 18:03  Brian Trammell <bht@cert.org>

	* [r4317] src/exparse.h: part of NAF aggregate/match library
	  refactor (in progress, keeping svn happy)

2006-06-23 16:58  Brian Trammell <bht@cert.org>

        * [r4154] src/nafz_indrv.c, src/nafz_inipfix.c: Fix warning in
          IPFIX input layer. Fix pointer corruption in driver layer - this
          was causing problems with SiLK and renaf.

2006-06-19 20:43  Brian Trammell <bht@cert.org>

        * [r4028] configure.in, src/drv_silk.c: Fix SiLK driver errors;
          final fix for configure bugs (add generic site, hardcoded).

2006-06-19 20:28  Brian Trammell <bht@cert.org>

        * [r4027] configure.in: Fixed silktools autoconf bugs.

2006-06-19 19:47  Brian Trammell <bht@cert.org>

        * [r4024] src/nafz_inipfix.c: Probably only need to check for sink
          rotation close once...

2006-06-19 19:45  Brian Trammell <bht@cert.org>

        * [r4023] src/nafalize.c, src/nafalize.h, src/nafz_inipfix.c,
          src/nafz_iocom.c: Add live rotation for IPFIX files, implement
          source ID support.

2006-06-19 18:41  Brian Trammell <bht@cert.org>

        * [r4019] NEWS, src/nafcore.c, src/nafz_inipfix.c: Fix options
          template skip support.

2006-06-16 20:47  Brian Trammell <bht@cert.org>

        * [r4004] src/nafz_inipfix.c: Debugging YAF->NAF IPFIX over TCP.
          This still doesn't work. Instead of NAF shutting down the stream
          on EOF, assuming "end of flow file", now it simply freezes (or
          rather, busywaits on a dead FixReader), because it appears
          autobounce is borked in fixbuf, at least for the TCP case. I'm
          done for the day and will screw with this this weekend. The base
          problem is largely due to the complexity of managing multiple
          input stream types with all their various desired behaviors, and
          the fact that MIO configuration, while not a particularly bad
          attempt at managing this complexity, is not a particularly good
          one either.

2006-06-16 20:34  Brian Trammell <bht@cert.org>

        * [r4003] src/aggregate.c, src/match.c, src/nafz_inipfix.c: fix
          IPFIX input bug that was breaking flow masking by setting the
          raw flow's mask length to zero.

2006-06-15 20:57  Brian Trammell <bht@cert.org>

        * [r3999] src/aggregate.c, src/aggregate.h, src/nafcore.c,
          src/nafz_indrv.c, src/nafz_inipfix.c, src/nafz_inpcap.c,
          src/nafz_iocom.c: Debugging for 0.5.0 release. Fix missing final
          aggregation and flush (this got dropped during the 0.5.0
          rewrite, it seems).

2006-06-15 19:55  Brian Trammell <bht@cert.org>

        * [r3995] src/match.c, src/nafz_inipfix.c: Prerelease testing
          bugfixes - fix longstanding horizon violation error, options
          record skip bug, and some IPFIX input drift in information
          element names.

2006-06-14 15:35  Brian Trammell <bht@cert.org>

        * [r3980] doc/nafalize.pod: Fix errors in MIO pcap argnames.

2006-06-14 14:03  Brian Trammell <bht@cert.org>

        * [r3976] doc/Makefile.am, doc/nafload.pod, src/nafz_inipfix.c:
          Minor pod typofix. Add IPFIX options record skip to NAF IPFIX
          input (because we're going to add reliability statistics to YAF)

2006-06-05 19:01  Brian Trammell <bht@cert.org>

        * [r3916] configure.in: (not quite working) autotools tweaks for
          auto-pod2man

2006-06-05 19:00  Brian Trammell <bht@cert.org>

        * [r3915] doc/Makefile.am, doc/nafalize.1, doc/nafilter.1,
          doc/nafload.1, doc/nafscii.1: Regenerate man pages. For some
          reason, the rules in Makefile.am don't do this for us. Will
          debug later.

2006-06-05 18:30  Brian Trammell <bht@cert.org>

        * [r3914] doc/nafalize.pod, doc/nafilter.pod, doc/nafload.pod,
          doc/nafscii.pod: Finish podification of NAF tools documentation
          set. Now we just need a way to build it...

2006-06-02 21:26  Brian Trammell <bht@cert.org>

        * [r3911] include/naf/lexcore.h, src/exparse.c, src/filter.c,
          src/lexcore.c, src/sort.c: Change the parser to conform to the
          docs; the syntax this required seemed a little ridiculous when I
          started telling other people about it...
        * [r3910] doc/nafalize.pod: More doc progress. Almost done with
          nafalize; the rest of the naf tools should go more quickly.

2006-06-01 20:43  Brian Trammell <bht@cert.org>

        * [r3908] trunk/naf/NAFSuite.xcodeproj/project.pbxproj,
          doc/nafalize.pod, src/exparse.c, src/nafalize.c: Release prep.
          Add POD documentation; rewriting NAF manual pages for clarity
          and the new format.

2006-06-01 15:30  Brian Trammell <bht@cert.org>

        * [r3903] src/exparse.c: Typofix in previous commit.

2006-06-01 15:26  Brian Trammell <bht@cert.org>

        * [r3902] include/naf/sort.h, src/aggregate.c, src/exparse.c,
          src/nafalize.h, src/nafilter.c, src/sort.c: Allow sorters to
          internally track whether they are defined. Integrate sorting
          into aggregation in nafalize. Build checkpoint.

2006-06-01 13:42  Brian Trammell <bht@cert.org>

        * [r3901] src/aggregate.c: Replace aggregation tree with
          aggregation table, which by not bothering to sort output by
          default native sort order seems informally to speed things up
          rather nicely. Next up is integrating arbitrary sorting.

2006-05-31 22:19  Brian Trammell <bht@cert.org>

        * [r3900] src/nafz_inipfix.c: Fix UDP timeout behavior in IPFIX
          input for nafalize. Build checkpoint.

2006-05-31 22:13  Brian Trammell <bht@cert.org>

        * [r3899] include/naf/nafcore.h, src/aggregate.c, src/nafalize.c,
          src/nafalize.h, src/nafz_inpcap.c: Build checkpoint - add
          periodic sink rotation to pcap input. Not yet tested. Some doc
          fixes, too.

2006-05-31 21:25  Brian Trammell <bht@cert.org>

        * [r3894] src/filter.c: Fix off-by-one error in time calculation.

2006-05-31 20:56  Brian Trammell <bht@cert.org>

        * [r3893] src/filter.c: Fix time parsing. Time filtering is still
          broken.

2006-05-31 20:48  Brian Trammell <bht@cert.org>

        * [r3892] src/lexcore.c: Fix lexcore bug that was causing integer
          parsing errors...

2006-05-31 19:19  Brian Trammell <bht@cert.org>

        * [r3887] src/nafcore.c, src/nafilter.c, src/sort.c: Debugging and
          cleanup. Sorting works now (haven't tested limit)

2006-05-31 18:48  Brian Trammell <bht@cert.org>

        * [r3886] src/nafilter.c, src/sort.c: More typofixes; debugging
          sort/filter expressions in nafilter.

2006-05-31 18:22  Brian Trammell <bht@cert.org>

        * [r3885] src/aggregate.c: more typofixes in port counting, which
          works now.

2006-05-31 17:58  Brian Trammell <bht@cert.org>

        * [r3884] src/nafcore.c, src/nafilter.c, src/nafscii.c: fix
          typobugs.

2006-05-31 17:13  Brian Trammell <bht@cert.org>

        * [r3883] include/Makefile.am, include/naf/lexcore.h,
          include/naf/sort.h, src/Makefile.am, src/lexcore.c,
          src/nafilter.c, src/sort.c: Integrate sorting into autotools
          build system. Integrate sorting into nafilter for testing. Minor
          bugfixes. Build checkpoint.

2006-05-30 22:06  Brian Trammell <bht@cert.org>

        * [r3879] include/naf/sort.h, src/sort.c: Sort parser printer
          build checkpoint; add primitives to header. Sorting is ready for
          test.

2006-05-30 21:28  Brian Trammell <bht@cert.org>

        * [r3877] include/naf/sort.h, src/sort.c: Forgot to implement
          limits; fixed.

2006-05-30 21:20  Brian Trammell <bht@cert.org>

        * [r3875] include/naf/lexcore.h, include/naf/sort.h,
          src/lexcore.c, src/sort.c: Build checkpoint for sort expression
          parser.

2006-05-30 18:26  Brian Trammell <bht@cert.org>

        * [r3874] include/naf/nafcore.h, include/naf/sort.h, src/sort.c:
          Add core of general NAFlow sorter.

2006-05-19 19:16  Brian Trammell <bht@cert.org>

        * [r3816] include/naf/lexcore.h, include/naf/nafcore.h,
          src/aggregate.c, src/dynflow.c, src/exparse.c, src/lexcore.c,
          src/match.c, src/nafalize.c, src/nafcore.c, src/nafload.c,
          src/nafscii.c: Add unique source and destination port counting.
          Build checkpoint. Will test this evening.

2006-05-19 17:11  Brian Trammell <bht@cert.org>

        * [r3808] src/filter.c: port time parser to portable timegm. Bin
          filtering is still disabled to defer the distraction of
          debugging this...

2006-05-19 15:34  Brian Trammell <bht@cert.org>

        * [r3807] src/filter.c: Disable time filtering so we can test
          value filtering.

2006-05-18 21:07  Brian Trammell <bht@cert.org>

        * [r3804] src/filter.c: Continued memory corruption bug hunting -
          EOD checkin. No progress.

2006-05-18 20:14  Brian Trammell <bht@cert.org>

        * [r3803] src/drv_argus.c, src/drv_silk.c, src/exparse.c,
          src/filter.c, src/nafalize.c, src/nafz_inipfix.c,
          src/nafz_inpcap.c: Change flow counter semantics to count
          uniflows always - this is 1. simpler and 2. more useful. Add
          time parsing (and unparsing) and filtering on bintime and data;
          this does not work yet due to what appear to be subtle memory
          corruption bugs, which I'm fixing now...

2006-05-16 21:36  Brian Trammell <bht@cert.org>

        * [r3793] src/filter.c: Build checkpoint of time parser. Still
          needs testing. NAF now does time filtering (bug 364) and value
          filtering (bug 380).

2006-05-16 21:08  Brian Trammell <bht@cert.org>

        * [r3792] src/aggregate.c, src/match.c: Value filtering
          integration. Turns out this seems reasonably easy once the API
          is designed correctly.

2006-05-16 20:33  Brian Trammell <bht@cert.org>

        * [r3790] include/naf/filter.h, src/aggregate.c, src/filter.c,
          src/match.c, src/nafilter.c: Split filter API for key and value
          - this is necessary to provide consistent semantics for value
          filtering in nafalize. Value filters and key filters except time
          will be parsed; but only key filters will be evaluated in
          nafalize and nafilter in this commit. This is equivalent to the
          0.4.5 behavior. Even so: build checkpoint, not tested.

2006-05-16 19:49  Brian Trammell <bht@cert.org>

        * [r3788] include/naf/filter.h, include/naf/lexcore.h,
          src/filter.c, src/lexcore.c, src/match.c: Add core support for
          value filtering and initial hooks for time bin filtering, as
          well. The points in match.c and aggregate.c where filtering
          integrates into nafalize will have to be slightly reworked due
          to the slightly different semantics of value filtering. Build
          checkpoint; not tested.

2006-05-16 17:37  Brian Trammell <bht@cert.org>

        * [r3781] src/nafcore.c: Definalize NAF output - NAF will no
          longer write final sets. Optimization for fixbuf template API
          changes - all NAF output now uses a single masked tid.

2006-05-08 19:28  Brian Trammell <bht@cert.org>

        * [r3689] include/naf/nafcore.h, src/nafalize.c, src/nafcore.c,
          src/nafilter.c, src/nafload.c, src/nafscii.c,
          src/nafz_inipfix.c: NAF fixbuf 0.4.0 template API refactor build
          checkpoint.

2006-05-05 19:30  Brian Trammell <bht@cert.org>

        * [r3669] src/drv_silk.c: fix ioc->mio bug in NAF silk driver

2006-05-05 17:37  Brian Trammell <bht@cert.org>

        * [r3666] src/nafz_inpcap.c: Fix build warning.

2006-05-04 21:16  Brian Trammell <bht@cert.org>

        * [r3657] src/Makefile.am, src/nafcore.c, src/nafscii.c,
          src/nafz_iocom.h: NAF MIO port initial testing complete -
          nafscii and nafalize seem to work again. Fix typobug in dipmask
          processing in nafscii. Fix build system errors.

2006-05-03 20:50  Brian Trammell <bht@cert.org>

        * [r3648] src/nafilter.c, src/nafload.c: more mio flags bugs in naf

2006-05-03 20:48  Brian Trammell <bht@cert.org>

        * [r3647] src/nafalize.c, src/nafscii.c: NAF debugging continues.
          Fix MIO flags errors in nafscii.

2006-05-02 20:51  Brian Trammell <bht@cert.org>

        * [r3631] src/nafalize.c, src/nafz_outfile.c, src/nafz_outfile.h:
          Still testing NAF/MIO. Fix sink type invariant failure. Open
          multiple and single output files differently.

2006-05-01 22:22  Brian Trammell <bht@cert.org>

        * [r3624] naf.spec, src/nafalize.c, src/nafcore.c,
          src/nafz_inpcap.c, src/nafz_outfile.c: Incremental nafalize/MIO
          integration debug. Still broken.

2006-04-26 15:26  Brian Trammell <bht@cert.org>

        * [r3571] trunk/naf/NAFSuite.xcodeproj/project.pbxproj,
          trunk/naf/airframe/AUTHORS, trunk/naf/fixbuf/AUTHORS, AUTHORS,
          src/Makefile.am, trunk/naf/yaf/AUTHORS: Boilerplate changes -
          suggested by ldcap boilerplate.

2006-04-26 14:29  Brian Trammell <bht@cert.org>

        * [r3565] configure.in: NAF no longer uses libyaf for yaf input -
          it does native ipfix input.

2006-04-21 14:09  Brian Trammell <bht@cert.org>

        * [r3509] trunk/naf/NAFSuite.xcodeproj/project.pbxproj,
          trunk/naf/airdbc/Makefile.am, trunk/naf/airdbc/configure.in,
          trunk/naf/airdbc/doc/Makefile.am,
          trunk/naf/airdbc/include/Makefile.am,
          trunk/naf/airdbc/include/airdbc/Makefile.am,
          trunk/naf/airdbc/include/airdbc/airdbc.h,
          trunk/naf/airdbc/include/airdbc/airdbc_drv.h,
          trunk/naf/airdbc/include/airdbc/drv_oci.h,
          trunk/naf/airdbc/include/airdbc/drv_pg.h,
          trunk/naf/airdbc/src/Makefile.am, trunk/naf/airdbc/src/airdbc.c,
          trunk/naf/airdbc/src/drv_oci.c, trunk/naf/airdbc/src/drv_pg.c,
          trunk/naf/airframe/Makefile.am, trunk/naf/airframe/configure.in,
          trunk/naf/airframe/doc/Makefile.am,
          trunk/naf/airframe/include/Makefile.am,
          trunk/naf/airframe/include/airframe/airutil.h,
          trunk/naf/airframe/include/airframe/daeconfig.h,
          trunk/naf/airframe/include/airframe/ioconfig.h,
          trunk/naf/airframe/include/airframe/logconfig.h,
          trunk/naf/airframe/include/airframe/mio.h,
          trunk/naf/airframe/include/airframe/mio_config.h,
          trunk/naf/airframe/include/airframe/mio_sink_file.h,
          trunk/naf/airframe/include/airframe/mio_sink_multi.h,
          trunk/naf/airframe/include/airframe/mio_sink_tcp.h,
          trunk/naf/airframe/include/airframe/mio_sink_udp.h,
          trunk/naf/airframe/include/airframe/mio_source_file.h,
          trunk/naf/airframe/include/airframe/mio_source_pcap.h,
          trunk/naf/airframe/include/airframe/mio_source_tcp.h,
          trunk/naf/airframe/include/airframe/mio_source_udp.h,
          trunk/naf/airframe/include/airframe/mio_stdio.h,
          trunk/naf/airframe/src/Makefile.am,
          trunk/naf/airframe/src/airutil.c,
          trunk/naf/airframe/src/daeconfig.c,
          trunk/naf/airframe/src/ioconfig.c,
          trunk/naf/airframe/src/logconfig.c,
          trunk/naf/airframe/src/mio.c,
          trunk/naf/airframe/src/mio_common_net.c,
          trunk/naf/airframe/src/mio_common_net.h,
          trunk/naf/airframe/src/mio_config.c,
          trunk/naf/airframe/src/mio_internal.h,
          trunk/naf/airframe/src/mio_sink_file.c,
          trunk/naf/airframe/src/mio_sink_multi.c,
          trunk/naf/airframe/src/mio_sink_tcp.c,
          trunk/naf/airframe/src/mio_sink_udp.c,
          trunk/naf/airframe/src/mio_source_file.c,
          trunk/naf/airframe/src/mio_source_pcap.c,
          trunk/naf/airframe/src/mio_source_tcp.c,
          trunk/naf/airframe/src/mio_source_udp.c,
          trunk/naf/airframe/src/mio_stdio.c,
          trunk/naf/fixbuf/Makefile.am, trunk/naf/fixbuf/configure.in,
          trunk/naf/fixbuf/doc/Makefile.am,
          trunk/naf/fixbuf/include/Makefile.am,
          trunk/naf/fixbuf/include/fixbuf/ie.h,
          trunk/naf/fixbuf/include/fixbuf/reader.h,
          trunk/naf/fixbuf/include/fixbuf/session.h,
          trunk/naf/fixbuf/include/fixbuf/template.h,
          trunk/naf/fixbuf/include/fixbuf/udp.h,
          trunk/naf/fixbuf/include/fixbuf/writer.h,
          trunk/naf/fixbuf/src/Makefile.am, trunk/naf/fixbuf/src/ie.c,
          trunk/naf/fixbuf/src/reader.c, trunk/naf/fixbuf/src/session.c,
          trunk/naf/fixbuf/src/template.c,
          trunk/naf/fixbuf/src/transcode.c,
          trunk/naf/fixbuf/src/transcode.h, trunk/naf/fixbuf/src/udp.c,
          trunk/naf/fixbuf/src/writer.c, Makefile.am, configure.in,
          doc/Makefile.am, include/Makefile.am, src/Makefile.am,
          trunk/naf/yaf/doc/Makefile.am: Relicense NAF suite library
          (airframe, airdbc, fixbuf) source code to a license that
          _actually exists_. (There is no v2 of the LGPL dated June 1991;
          the proper license is v2.1 of February 1999).

2006-04-19 14:48  Brian Trammell <bht@cert.org>

        * [r3482] src/nafz_inipfix.c: IE name changes. Information model
          now spells timestamps correctly.

2006-04-18 21:26  Brian Trammell <bht@cert.org>

        * [r3478] src/nafcore.c: Some IE names changed due to AD review;
          cascade changes to NAF.

2006-04-17 19:23  Brian Trammell <bht@cert.org>

        * [r3445] src/nafload.c: oops - save skew. _this_ is the testable
          nafload.

2006-04-17 18:55  Brian Trammell <bht@cert.org>

        * [r3443] src/nafload.c, src/nafscii.c: nafload build checkpoint.
          Testing begins when I'm done adding YAF to SiLK.

2006-04-17 06:49  Brian Trammell <bht@cert.org>

        * [r3439] src/nafilter.c, src/nafscii.c: (old) nafilter builds
          with MIO support now. Only nafload needs mio support before the
          whole MIO NAF port will be build checkpointed.

2006-04-16 21:11  Brian Trammell <bht@cert.org>

        * [r3438] src/nafilter.c: nafilter refactor EOD checkin - done
          save build errors and a new main().

2006-04-14 15:23  Brian Trammell <bht@cert.org>

        * [r3426] src/nafalize.c, src/nafscii.c: nafscii MIO port build
          checkpoint.

2006-04-13 21:16  Brian Trammell <bht@cert.org>

        * [r3424] src/nafscii.c: Halfway to a nafscii MIO port.

2006-04-12 20:36  Brian Trammell <bht@cert.org>

        * [r3423] include/naf/autoinc.h, include/naf/dynflow.h,
          include/naf/nafcore.h, src/aggregate.c, src/aggregate.h,
          src/drv_argus.c, src/drv_renaf.c, src/drv_silk.c, src/dynflow.c,
          src/exparse.h, src/match.c, src/match.h, src/nafalize.c,
          src/nafalize.h, src/nafcore.c, src/nafilter.c, src/nafload.c,
          src/nafscii.c, src/nafz_indrv.c, src/nafz_indrv.h,
          src/nafz_inipfix.c, src/nafz_inpcap.c, src/nafz_iocom.c,
          src/nafz_iocom.h, src/nafz_outfile.c, src/nafz_outfile.h:
          Refactor build checkpoint. WARNING. NOT TESTED. nafalize (and
          only nafalize) builds in XCode now. Other app MIO ports and
          testing remain to be done.

2006-04-12 18:05  Brian Trammell <bht@cert.org>

        * [r3418] src/naf_incom.c, src/naf_incom.h, src/naf_indrv.c,
          src/naf_indrv.h, src/naf_ipfix.c, src/naf_ipfix.h,
          src/naf_outfile.c, src/naf_outfile.h, src/naf_pcap.c,
          src/naf_pcap.h, src/nafz_indrv.c, src/nafz_indrv.h,
          src/nafz_inipfix.c, src/nafz_inipfix.h, src/nafz_inpcap.c,
          src/nafz_inpcap.h, src/nafz_iocom.c, src/nafz_iocom.h,
          src/nafz_outfile.c, src/nafz_outfile.h: Source file renaming to
          reflect that NAF split I/O files are not NAF-universal.

2006-04-12 18:02  Brian Trammell <bht@cert.org>

        * [r3417] src/aggregate.c, src/aggregate.h, src/drv_argus.c,
          src/drv_argus.h, src/drv_renaf.c, src/drv_renaf.h,
          src/drv_silk.c, src/drv_silk.h, src/dynflow.c, src/exparse.c,
          src/exparse.h, src/filter.c, src/lexcore.c, src/match.c,
          src/match.h, src/naf_incom.c, src/naf_incom.h, src/naf_indrv.c,
          src/naf_indrv.h, src/naf_ipfix.c, src/naf_ipfix.h,
          src/naf_outfile.c, src/naf_outfile.h, src/naf_pcap.c,
          src/naf_pcap.h, src/nafalize.c, src/nafcore.c, src/nafilter.c,
          src/nafload.c, src/nafscii.c: Set ID property on all NAF
          sources, and add RCSID where not yet present.

2006-04-12 17:52  Brian Trammell <bht@cert.org>

        * [r3416] src/Makefile.am, src/drv_argus.c, src/drv_argus.h,
          src/drv_renaf.c, src/drv_renaf.h, src/drv_silk.c,
          src/drv_silk.h, src/nafalize.c: Second intermediate refactoring
          commit...

2006-04-12 17:51  Brian Trammell <bht@cert.org>

        * [r3415] configure.in, src/drv_argus.c, src/drv_silk.c,
          src/drv_silk.h, src/naf_incom.c, src/naf_incom.h,
          src/naf_indrv.c, src/naf_indrv.h, src/naf_ipfix.c,
          src/naf_ipfix.h, src/naf_outfile.c, src/naf_outfile.h,
          src/naf_pcap.c, src/naf_pcap.h, src/nafalize.c: Intermediate
          refactor commit - still doesn't build but will by EOD. Preparing
          to rename the new "split" I/O backend to be less confusing...

2006-04-10 20:51  Brian Trammell <bht@cert.org>

        * [r3396] src/match.c, src/match.h, src/nafalize.c: Continued
          refactoring. Match interface tweak. nafalize main() has now
          taken its final form. Only needs file pattern munge and file
          sink implementation now. No, this still does not build.

2006-04-07 21:15  Brian Trammell <bht@cert.org>

        * [r3386] src/naf_ipfix.h, src/nafalize.c: EOD refactor commit.
          Fix naf_ipfix header. Suck MIO sink configuration into nafalize
          (because I'll prototype mio multisink configuration support
          within nafalize). Pull old nafz_setup code up into main() --
          this is ugly and I'll want to clean it up a bit on Monday.

2006-04-06 21:13  Brian Trammell <bht@cert.org>

        * [r3383] src/nafalize.c: EOD checkin - begin work on rewriting
          NAF main around the refactor.

2006-04-06 19:48  Brian Trammell <bht@cert.org>

        * [r3382] include/naf/nafcore.h, src/drv_renaf.c, src/nafcore.c:
          NAF core changes for MIO. Renaf driver complete.

2006-04-06 18:47  Brian Trammell <bht@cert.org>

        * [r3381] src/Makefile.am: Autotools changes for driver
          apocalypse. Still won't build.

2006-04-06 18:24  Brian Trammell <bht@cert.org>

        * [r3380] src/argus.c, src/argus.h, src/drv_argus.c,
          src/drv_argus.h, src/drv_renaf.c, src/drv_renaf.h,
          src/drv_silk.c, src/drv_silk.h, src/nsilk.c, src/nsilk.h,
          src/renaf.c, src/renaf.h: The Great Driver Apocalypse Continues
          - port Argus and SiLK drivers to MIO. Renaf driver port to MIO
          will require nafcore changes; upcoming.

2006-04-05 20:53  Brian Trammell <bht@cert.org>

        * [r3375] src/naf_incom.h, src/naf_indrv.c, src/naf_indrv.h,
          src/naf_ipfix.c: Nice, big, incompatible change to the driver
          interface for the MIO port. The drivers (only renaf, silk, and
          argus remain) will need to be modified accordingly. Needless to
          say, NAF still does not build.

2006-04-05 20:14  Brian Trammell <bht@cert.org>

        * [r3374] src/naf_indrv.h, src/nyaf.c, src/nyaf.h: Beginning of
          driver input port to MIO. Remove YAF driver, because YAF is now
          covered by IPFIX input.

2006-04-05 19:19  Brian Trammell <bht@cert.org>

        * [r3370] src/naf_incom.h, src/naf_ipfix.c, src/naf_ipfix.h,
          src/naf_pcap.c, src/naf_pcap.h: Minor bugfixes. Add IPFIX import
          in naf_ipfix.[ch]; largely stolen and modified from yafcollect.

2006-04-04 21:03  Brian Trammell <bht@cert.org>

        * [r3357] src/aggregate.c, src/aggregate.h, src/exparse.h,
          src/naf_incom.c, src/naf_incom.h, src/naf_indrv.c,
          src/naf_indrv.h, src/naf_ipfix.c, src/naf_pcap.c,
          src/naf_pcap.h, src/rawinput.c, src/rawinput.h: NAF pcap
          refactor for MIO port. Split common raw input and driver support
          into separate modules; naf_incom.c contains the interface
          between the input and output sides now. Will continue this
          refactoring of the "middle" with naf_ipfix and naf_indrv (which
          will handle renaf, silk, and argus), then will rebuild the
          front-end and control flow around this. Doesn't build. Won't
          tomorrow, either.

2006-04-04 15:39  Brian Trammell <bht@cert.org>

        * [r3353] src/Makefile.am, src/naf_ipfix.c, src/naf_ipfix.h,
          src/naf_pcap.c, src/naf_pcap.h, src/nafalize.c, src/npcap.c,
          src/npcap.h: Begin NAF MIO port; teardown phase. Promote pcap
          input to "first order" (i.e., not moderated by the driver
          interface), because the layering's broken anyway. and we might
          as well take advantage of it. Create new first order IPFIX
          input; this will hold a straight port of the yafcollect
          multiple-timebase, multiple-counter IPFIX input to NAF raw
          flows. Next up - make pcap interface MIO-friendly. NAF HEAD will
          not build for the next couple of days or so.

2006-03-30 21:57  Brian Trammell <bht@cert.org>

        * [r3325] trunk/naf/NAFSuite.xcodeproj/project.pbxproj,
          doc/nafalize.1: xcode build system periodic checkin

2006-03-03 03:15  Brian Trammell <bht@cert.org>

        * [r3139] trunk/naf/NAFSuite.xcodeproj/project.pbxproj: 
          IPFIX interop fixes.
          Change XCode project to 1) disable F&C/ZeroLink, which may have
          been causing GDB problems, and 2) fix symbol duplication in
          yafcollect target, which almost certainly was. 
          
2006-02-23 20:39  Tony Cebzanov <tonyc@cert.org>

        * [r3080] trunk/naf/airdbc/airdbc.xcodeproj,
          trunk/naf/airframe/airframe.xcodeproj,
          trunk/naf/fixbuf/libfixbuf.xcodeproj, naf.xcodeproj: Purging old
          project files.

2006-02-14 22:10  Brian Trammell <bht@cert.org>

        * [r3006] src/match.c: inconsequential source reorg from Monday's
          review.

2006-02-14 19:45  Tony Cebzanov <tonyc@cert.org>

        * [r3001] naf.spec: Added some missing files

2006-02-11 00:33  Tony Cebzanov <tonyc@cert.org>

        * [r2993] naf.spec: Specfile for NAF tools. Not tested yet because
          we need new libpcap for AS3.

2006-02-08 23:12  Brian Trammell <bht@cert.org>

        * [r2962] src/nafcore.c: fix privatization bug

2006-02-06 21:23  Brian Trammell <bht@cert.org>

        * [r2931] trunk/naf/NAFSuite.xcodeproj/project.pbxproj,
          include/naf/nafcore.h: nafcore doc tweak. NAFSuite project EOD.

2006-02-06 19:11  Brian Trammell <bht@cert.org>

        * [r2924] ChangeLog, README, doc/web/index.html: 0.4.5 doc tweaks.

2006-02-03 17:13  Brian Trammell <bht@cert.org>

	* [r2901] include/naf/nafcore.h, src/nyaf.c: Doc typofix. Modify
	  YAF input driver for millisecond interface.

2006-01-31 22:29  Brian Trammell <bht@cert.org>

	* [r2877] src/nafcore.c: endianness typofix in naf options record
	  read.

2006-01-31 22:28  Brian Trammell <bht@cert.org>

	* [r2876] src/nafcore.c: fixbuf API sync - replace write_raw()
	  with write() for options record.

2006-01-26 22:34  Brian Trammell <bht@cert.org>

	* [r2862] src/nafcore.c: Fix reader code. nafalize and nafscii
	  tested against new fixbuf.

2006-01-26 21:55  Brian Trammell <bht@cert.org>

	* [r2859] src/nafcore.c: More IPFIX intercap fixes. sourceId, not
	  sourceID.

2006-01-26 20:59  Brian Trammell <bht@cert.org>

	* [r2858] src/nafcore.c: Switch to new FixTemplateSpec API. Adapt
	  template-mask map to use appext field of FixTemplateSpec. Add
	  ytidmap, to cache FixTemplateSpec walk results. Hook ytidmap up
	  to new template invalidation hook.

2006-01-19 16:11  Brian Trammell <bht@cert.org>

	* [r2823] src/nafload.c, src/nyaf.c: Track YAF API changes. Add
	  --sid support to nafload, too.

2006-01-19 14:24  Brian Trammell <bht@cert.org>

	* [r2820] src/nafalize.c: fix missing --sid handling in nafalize
	  (Bug 375).

2006-01-17 21:10  Brian Trammell <bht@cert.org>

	* [r2806] configure.in, naf.xcodeproj/project.pbxproj: Build
	  system fixes

2006-01-17 18:45  Brian Trammell <bht@cert.org>

	* [r2801] include/naf/dynflow.h, include/naf/filter.h,
	  include/naf/nafcore.h, src/aggregate.c, src/aggregate.h,
	  src/argus.c, src/dynflow.c, src/exparse.c, src/exparse.h,
	  src/filter.c, src/match.c, src/match.h, src/nafalize.c,
	  src/nafcore.c, src/nafilter.c, src/nafload.c, src/nafscii.c,
	  src/npcap.c, src/npcap.h, src/nsilk.c, src/nyaf.c,
	  src/rawinput.c, src/rawinput.h, src/renaf.c: 0.4.5, less
	  documentation. Change NAF API to be more glib-like, as decided.

2006-01-17 14:49  Brian Trammell <bht@cert.org>

	* [r2797] configure.in, naf.xcodeproj/project.pbxproj,
	  src/Makefile.am, src/nafalize.c, src/nafload.c, src/npcap.c,
	  src/nyaf.c, src/nyaf.h: Add YAF input driver. Add --autolabel
	  support to nafload. Build-tested, but DO NOT USE THIS YET; the
	  next NAF checkin will include big API changes.

2006-01-16 18:26  Brian Trammell <bht@cert.org>

	* [r2791] configure.in, src/nafload.c: 0.4.5 - add nafload
	  --label. Needs docs.

2006-01-12 18:56  Brian Trammell <bht@cert.org>

	* [r2780] src/argus.c, src/nafalize.c, src/nafcore.c,
	  src/nafilter.c, src/nafload.c, src/nafscii.c, src/npcap.c,
	  src/nsilk.c, src/rawinput.h, src/renaf.c: Port to external
	  Airframe.

2006-01-06 20:45  Brian Trammell <bht@cert.org>

	* [r2770] README, configure.in, doc/web/index.html,
	  naf.xcodeproj/project.pbxproj, src/Makefile.am: Build system
	  works. Add hack to assume required NetSA libs are in the NAF
	  prefix.

2006-01-06 19:19  Brian Trammell <bht@cert.org>

	* [r2769] AUTHORS, Doxyfile.libairframe, configure.in,
	  doc/web/Makefile.am, doc/web/airframe, doc/web/index.html,
	  include/Makefile.am, include/airframe,
	  naf.xcodeproj/project.pbxproj, src/Makefile.am, src/airutil.c,
	  src/daeconfig.c, src/ioconfig.c, src/logconfig.c: Fix libtool
	  bugs. Excise airframe from NAF tree; add external dependency on
	  libairframe 0.5.0.

2006-01-04 20:20  Brian Trammell <bht@cert.org>

	* [r2746] doc/web/index.html: Web page tweak.

2006-01-04 16:30  Brian Trammell <bht@cert.org>

	* [r2741] src/Makefile.am: Yet more autotools fixes.

2006-01-04 16:07  Brian Trammell <bht@cert.org>

	* [r2740] src/Makefile.am: Fix yet another NAF build system error
	  on Linux.

2006-01-03 21:56  Brian Trammell <bht@cert.org>

	* [r2734] NEWS, doc/web/index.html, doc/web/nafalize.1.html,
	  doc/web/nafilter.1.html, doc/web/nafload.1.html,
	  doc/web/nafscii.1.html: Web documentation changes for 0.4.2
	  release.

2006-01-03 21:48  Brian Trammell <bht@cert.org>

	* [r2733] ChangeLog, NEWS, README, naf.xcodeproj/project.pbxproj:
	  Documentation tweaks for 0.4.2 release.

2006-01-03 15:45  Brian Trammell <bht@cert.org>

	* [r2727] doc/nafilter.1: nafilter doc tweaks for TopN support.

2006-01-03 15:45  Brian Trammell <bht@cert.org>

	* [r2727] doc/nafilter.1: nafilter doc tweaks for TopN support.

2006-01-03 15:16  Brian Trammell <bht@cert.org>

	* [r2726] src/nafilter.c: Fix TopN ordering bug. nafilter TopN
	  appears to work now.

2006-01-03 15:05  Brian Trammell <bht@cert.org>

	* [r2725] naf.xcodeproj/project.pbxproj, src/lexcore.c,
	  src/nafilter.c: Fix null context and parser initialization
	  errors for TopN in nafilter. Still working on ordering issues.

2006-01-03 13:48  Brian Trammell <bht@cert.org>

	* [r2724] src/Makefile.am, src/dynflow.c, src/nafcore.c: Fix
	  autotools typos and NAF core flow/reverse flow count mix-up
	  typobug.

2005-12-22 20:16  Brian Trammell <bht@cert.org>

	* [r2723] trunk/naf/airdbc/airdbc.xcodeproj/project.pbxproj,
	  configure.in, include/naf/nafcore.h, src/exparse.c,
	  src/nafalize.c, src/nafcore.c, src/nafilter.c, src/nafload.c,
	  src/nafscii.c: draft-boschi-ipfix-biflow compliance. Builds,
	  tested. pre-0.4.2 and post-0.4.2 NAF files are now mutually
	  unintelligable; a compatibility layer would not take much work
	  but, given the lack of any existing long-term NAF data storage,
	  would be a waste of effort. nafilter TopN testing continues;
	  does not appear to work. Debugging will have to wait for next
	  year.

2005-12-22 19:00  Brian Trammell <bht@cert.org>

	* [r2719] naf.xcodeproj/project.pbxproj, src/nafilter.c: nafilter
	  TopN implementation done. Testing begins.

2005-12-22 18:55  Brian Trammell <bht@cert.org>

	* [r2718] include/naf/dynflow.h, src/dynflow.h: Move dynflow
	  include into library.
	* [r2717] include/Makefile.am, include/naf/lexcore.h,
	  include/naf/nafcore.h, naf.xcodeproj/project.pbxproj,
	  src/Makefile.am, src/aggregate.c, src/dynflow.c, src/dynflow.h,
	  src/lexcore.c, src/match.c, src/nafalize.c, src/nafilter.c:
	  Incremental commit before move of dynflow into library and
	  addition of TopN feature to nafilter. This revision does not
	  build.

2005-12-21 21:16  Brian Trammell <bht@cert.org>

	* [r2715] naf.xcodeproj/project.pbxproj, src/aggregate.c,
	  src/ioconfig.c, src/match.c, src/nafalize.c: Track down
	  invariant violation in aggregate; an uninitialized value caused
	  aggregate to return an spurious error in some circumstances when
	  flushing an empty bin. Add safe error printing to ioconfig to
	  protect ioconfig against and application returning FALSE without
	  setting error.

2005-12-19 16:50  Brian Trammell <bht@cert.org>

	* [r2698] src/nafcore.c: switch from "final message" to "MTU"
	  semantics for writing messages.

2005-12-19 16:49  Brian Trammell <bht@cert.org>

	* [r2697] configure.in, doc/web/index.html, include/naf/autoinc.h,
	  include/naf/nafcore.h, src/aggregate.c, src/aggregate.h,
	  src/nafalize.c, src/nafcore.c, src/nafilter.c, src/nafload.c,
	  src/nafscii.c, src/renaf.c: Port NAF to fixbuf 0.2.0. Build
	  checkpoint.

2005-12-15 20:27  Brian Trammell <bht@cert.org>

	* [r2676] naf.xcodeproj/project.pbxproj, src/argus.c,
	  src/flowtab.c, src/flowtab.h, src/npcap.c, src/nsilk.c,
	  src/renaf.c: Remove flowtab.[ch] (as all of its functionality
	  lives in match and aggregate now) and remove spurious references
	  to it.

2005-12-15 18:13  Brian Trammell <bht@cert.org>

	* [r2675] src/nafilter.c, src/nafscii.c: Change multiple I/O to
	  handle to-file output in single input case. Change nafilter to
	  write naf files, instead of text.

2005-12-15 15:27  Brian Trammell <bht@cert.org>

	* [r2674] src/match.c: Add assert to catch potential missing bin
	  in table.

2005-12-14 23:03  Brian Trammell <bht@cert.org>

	* [r2673] src/match.c: Fix (stupid) match bin initialization bug.
	  Rework bin splitting algorithm to avoid unnecessary divisions at
	  the expense of a corner case (octet count less than bin count)
	  that we don't much care about anyway.

2005-12-14 21:57  Brian Trammell <bht@cert.org>

	* [r2672] src/match.c: Debugging assert for scribble tracking.

2005-12-14 21:37  Brian Trammell <bht@cert.org>

	* [r2671] src/match.c: Another SIGFPE fix.

2005-12-14 21:31  Brian Trammell <bht@cert.org>

	* [r2670] naf.xcodeproj/project.pbxproj, src/match.c: Fix divide
	  by zero bug in uniform splitting for i386.

2005-12-14 20:37  Brian Trammell <bht@cert.org>

	* [r2669] include/naf/autoinc.h: Add missing libnaf autoinc.

2005-12-14 20:03  Brian Trammell <bht@cert.org>

	* [r2668] src/Makefile.am: Linux build error fixes.

2005-12-14 17:46  Brian Trammell <bht@cert.org>

	* [r2664] configure.in, include/airframe/autoinc.h,
	  src/nafalize.c: Fix missing stdint, add dmalloc support.

2005-12-14 14:56  Brian Trammell <bht@cert.org>

	* [r2663] naf.xcodeproj/project.pbxproj, src/filter.c,
	  src/nafilter.c: XCode build system configuration cleanup, and
	  multiple -Wmost fixes. In pursuit of argus2 scribble bug...

2005-12-13 22:10  Brian Trammell <bht@cert.org>

	* [r2662] src/match.c: Fix uninitialized memory bug with split
	  bins.

2005-12-13 21:37  Brian Trammell <bht@cert.org>

	* [r2661] NEWS, configure.in, doc/Makefile.am,
	  doc/web/airframe/Makefile.am, src/Makefile.am, src/match.c,
	  src/nafalize.c: NAF 0.4.0 prerelease for testing. Fix build
	  system to point to new flow table implementation. Fix build
	  system for 0.4.0 dist build. A couple more things (re-Doxygen,
	  Changelog) need to happen before a release tarball can be built;
	  otherwise, this is feature-complete for testing.

2005-12-13 16:26  Brian Trammell <bht@cert.org>

	* [r2652] src/match.c: Fix spurious hashtable free bug. Testing
	  continues.

2005-12-13 16:18  Brian Trammell <bht@cert.org>

	* [r2651] include/naf/nafcore.h, naf.xcodeproj/project.pbxproj,
	  src/aggregate.c, src/aggregate.h, src/dynflow.c, src/dynflow.h,
	  src/match.c, src/match.h, src/nafalize.c: Integrated new flow
	  table into nafalize, modified perimeter mode to do perimeter
	  reversal before prefilter. XCode build checkpoint. This code is
	  unstable, and does not work yet.

2005-12-13 14:24  Brian Trammell <bht@cert.org>

	* [r2650] src/aggregate.c, src/match.h: NAF aggregation
	  pre-integration checkin.

2005-12-12 22:33  Brian Trammell <bht@cert.org>

	* [r2649] src/aggregate.c, src/dynflow.c, src/dynflow.h,
	  src/match.c, src/match.h: Continued work on new flow table. Add
	  aggregate primitives. Fix match and dynflow to use memchunks to
	  their fullest capacity. Next up, a naf_flush to put it all
	  together.

2005-12-12 16:03  Brian Trammell <bht@cert.org>

	* [r2642] src/dynflow.c, src/dynflow.h, src/match.c, src/match.h:
	  Complete match-side interface between match and aggregate. Move
	  all utility functions dealing with flow dynamics into dynflow.c.

2005-12-09 22:46  Brian Trammell <bht@cert.org>

	* [r2640] naf.xcodeproj/project.pbxproj, src/dynflow.c,
	  src/dynflow.h, src/match.c: Implement first stage queue/hash
	  based flow table. Still need interface to second stage.

2005-12-09 19:39  Brian Trammell <bht@cert.org>

	* [r2638] src/aggregate.c, src/dynflow.c, src/dynflow.h,
	  src/exparse.c, src/match.c: Incremental progress on
	  higher-performance flow table. Split dynamic flow memory
	  management out into its own file, to be shared by match and
	  aggregate. Begin defining a first-stage table that replaces a
	  round-robin array with a queue (allowing for lazy flushing, or
	  flushing by a secondary thread). None of this new code builds,
	  which is okay because it's not referenced by any build system
	  yet.

2005-12-09 15:09  Brian Trammell <bht@cert.org>

	* [r2637] README, doc/nafalize.1, doc/nafilter.1,
	  doc/web/index.html, doc/web/nafalize.1.html,
	  doc/web/nafilter.1.html, doc/web/nafload.1.html,
	  doc/web/nafscii.1.html, naf.xcodeproj/project.pbxproj: Continued
	  documentation prep. Update README and all manual web files.
	  Tweaks to NAF manpages.

2005-12-09 14:20  Brian Trammell <bht@cert.org>

	* [r2636] AUTHORS, Doxyfile.libairframe, Doxyfile.libnaf,
	  doc/web/airframe/airutil_8h-source.html,
	  doc/web/airframe/airutil_8h.html,
	  doc/web/airframe/annotated.html,
	  doc/web/airframe/autoinc_8h-source.html,
	  doc/web/airframe/autoinc_8h.html,
	  doc/web/airframe/daeconfig_8h-source.html,
	  doc/web/airframe/daeconfig_8h.html, doc/web/airframe/files.html,
	  doc/web/airframe/functions.html,
	  doc/web/airframe/functions_vars.html,
	  doc/web/airframe/globals.html,
	  doc/web/airframe/globals_defs.html,
	  doc/web/airframe/globals_enum.html,
	  doc/web/airframe/globals_eval.html,
	  doc/web/airframe/globals_func.html,
	  doc/web/airframe/globals_type.html, doc/web/airframe/index.html,
	  doc/web/airframe/ioconfig_8h-source.html,
	  doc/web/airframe/ioconfig_8h.html,
	  doc/web/airframe/logconfig_8h-source.html,
	  doc/web/airframe/logconfig_8h.html,
	  doc/web/airframe/structioc__file__st.html,
	  doc/web/libnaf/annotated.html,
	  doc/web/libnaf/autoinc_8h-source.html,
	  doc/web/libnaf/autoinc_8h.html, doc/web/libnaf/files.html,
	  doc/web/libnaf/filter_8h-source.html,
	  doc/web/libnaf/filter_8h.html, doc/web/libnaf/functions.html,
	  doc/web/libnaf/functions_vars.html, doc/web/libnaf/globals.html,
	  doc/web/libnaf/globals_defs.html,
	  doc/web/libnaf/globals_func.html,
	  doc/web/libnaf/globals_type.html,
	  doc/web/libnaf/globals_vars.html, doc/web/libnaf/index.html,
	  doc/web/libnaf/lexcore_8h-source.html,
	  doc/web/libnaf/lexcore_8h.html,
	  doc/web/libnaf/nafcore_8h-source.html,
	  doc/web/libnaf/nafcore_8h.html,
	  doc/web/libnaf/structnaf__filter__st.html,
	  doc/web/libnaf/structnaf__flowkey__st.html,
	  doc/web/libnaf/structnaf__flowmask__st.html,
	  doc/web/libnaf/structnaf__flowval__st.html,
	  naf.xcodeproj/project.pbxproj: Doxygen regeneration at new paths
	  (to make sure the hack in the doxyfile actually worked).

2005-12-09 14:17  Brian Trammell <bht@cert.org>

	* [r2635] doc/Makefile.am, doc/airframe, doc/libnaf,
	  doc/web/Makefile.am, doc/web/airframe, doc/web/libnaf:
	  Reorganize Doxygen documentation to place it in the web
	  directory (for easy one-stop publishing to sourceforge)

2005-12-09 05:05  Brian Trammell <bht@cert.org>

	* [r2634] doc/nafalize.1, doc/nafilter.1: Finish NAF 0.4.0
	  manpages.

2005-12-08 22:32  Brian Trammell <bht@cert.org>

	* [r2633] NEWS, doc/nafalize.1: Incremental documentation progress.

2005-12-08 21:17  Brian Trammell <bht@cert.org>

	* [r2632] Doxyfile.libairframe, Doxyfile.libnaf, NEWS,
	  configure.in, doc/Doxyfoot.html, doc/Makefile.am, doc/airframe,
	  doc/airframe/Makefile.am, doc/airframe/html,
	  doc/airframe/html/Makefile.am,
	  doc/airframe/html/airutil_8h-source.html,
	  doc/airframe/html/airutil_8h.html,
	  doc/airframe/html/annotated.html,
	  doc/airframe/html/autoinc_8h-source.html,
	  doc/airframe/html/autoinc_8h.html,
	  doc/airframe/html/daeconfig_8h-source.html,
	  doc/airframe/html/daeconfig_8h.html,
	  doc/airframe/html/doxygen.css, doc/airframe/html/doxygen.png,
	  doc/airframe/html/files.html, doc/airframe/html/functions.html,
	  doc/airframe/html/functions_vars.html,
	  doc/airframe/html/globals.html,
	  doc/airframe/html/globals_defs.html,
	  doc/airframe/html/globals_enum.html,
	  doc/airframe/html/globals_eval.html,
	  doc/airframe/html/globals_func.html,
	  doc/airframe/html/globals_type.html,
	  doc/airframe/html/index.html,
	  doc/airframe/html/ioconfig_8h-source.html,
	  doc/airframe/html/ioconfig_8h.html,
	  doc/airframe/html/logconfig_8h-source.html,
	  doc/airframe/html/logconfig_8h.html,
	  doc/airframe/html/structioc__file__st.html,
	  doc/airframe/html/tab_b.gif, doc/airframe/html/tab_l.gif,
	  doc/airframe/html/tab_r.gif, doc/airframe/html/tabs.css,
	  doc/libnaf, doc/libnaf/Makefile.am, doc/libnaf/html,
	  doc/libnaf/html/Makefile.am, doc/libnaf/html/annotated.html,
	  doc/libnaf/html/autoinc_8h-source.html,
	  doc/libnaf/html/autoinc_8h.html, doc/libnaf/html/doxygen.css,
	  doc/libnaf/html/doxygen.png, doc/libnaf/html/files.html,
	  doc/libnaf/html/filter_8h-source.html,
	  doc/libnaf/html/filter_8h.html, doc/libnaf/html/functions.html,
	  doc/libnaf/html/functions_vars.html,
	  doc/libnaf/html/globals.html, doc/libnaf/html/globals_defs.html,
	  doc/libnaf/html/globals_func.html,
	  doc/libnaf/html/globals_type.html,
	  doc/libnaf/html/globals_vars.html, doc/libnaf/html/index.html,
	  doc/libnaf/html/lexcore_8h-source.html,
	  doc/libnaf/html/lexcore_8h.html,
	  doc/libnaf/html/nafcore_8h-source.html,
	  doc/libnaf/html/nafcore_8h.html,
	  doc/libnaf/html/structnaf__filter__st.html,
	  doc/libnaf/html/structnaf__flowkey__st.html,
	  doc/libnaf/html/structnaf__flowmask__st.html,
	  doc/libnaf/html/structnaf__flowval__st.html,
	  doc/libnaf/html/tab_b.gif, doc/libnaf/html/tab_l.gif,
	  doc/libnaf/html/tab_r.gif, doc/libnaf/html/tabs.css,
	  doc/nafilter.1, doc/web/nafilter.1.html,
	  include/airframe/autoinc.h, include/airframe/ioconfig.h,
	  include/naf/lexcore.h, include/naf/nafcore.h,
	  naf.xcodeproj/project.pbxproj: Giant Doxygen checkin. Add web
	  documentation for NAF libraries. Add man stub for nafilter.
	  Tweak header files for Doxygen happiness.

2005-12-08 20:16  Brian Trammell <bht@cert.org>

	* [r2631] configure.in, include/airframe/airutil.h,
	  include/naf/filter.h, include/naf/lexcore.h,
	  include/naf/nafcore.h, src/filter.c, src/flowtab.c,
	  src/nafcore.c, src/nafilter.c: Complete Doxidation of nafcore.
	  Minor nafcore API tweaks for cleanliness. Next up is actually
	  building Doxy docs, and finishing 0.4 release documentation.

2005-12-07 22:26  Brian Trammell <bht@cert.org>

	* [r2630] include/airframe/airutil.h,
	  include/airframe/daeconfig.h, include/airframe/ioconfig.h,
	  include/airframe/logconfig.h, naf.xcodeproj/project.pbxproj,
	  src/airutil.c, src/ioconfig.c, src/nafalize.c: Add airframe
	  documentation in Doxygen format.

2005-12-07 05:50  Brian Trammell <bht@cert.org>

	* [r2629] Makefile.am: ... Or not. Fix autotools build system bug
	  for libnaf/libairframe in NAF. NAF has now been successfully
	  split into library and application parts.

2005-12-07 05:43  Brian Trammell <bht@cert.org>

	* [r2628] configure.in, include/Makefile.am, src/Makefile.am:
	  Autotools build system successfully builds libairframe and
	  libnaf, but does not appear to install headers yet. This is a
	  problem for tomorrow...

2005-12-07 05:30  Brian Trammell <bht@cert.org>

	* [r2627] include/airframe/autoinc.h,
	  naf.xcodeproj/project.pbxproj, src/autoinc.h, src/nafcore.c,
	  src/nafload.c, src/nafscii.c, src/npcap.c: Reorg build
	  checkpoint - libairframe/libnaf reorganized code now builds with
	  reorganized XCode build system.

2005-12-07 05:12  Brian Trammell <bht@cert.org>

	* [r2626] configure.in, include, include/Makefile.am,
	  include/airframe, include/airframe/airutil.h,
	  include/airframe/daeconfig.h, include/airframe/ioconfig.h,
	  include/airframe/logconfig.h, include/naf, include/naf/filter.h,
	  include/naf/lexcore.h, include/naf/nafcore.h,
	  naf.xcodeproj/project.pbxproj, src/Makefile.am, src/aggregate.c,
	  src/airutil.c, src/airutil.h, src/argus.c, src/autoinc.h,
	  src/daeconfig.c, src/daeconfig.h, src/exparse.c, src/exparse.h,
	  src/filter.c, src/filter.h, src/flowtab.c, src/flowtab.h,
	  src/ioconfig.c, src/ioconfig.h, src/lexcore.c, src/lexcore.h,
	  src/logconfig.c, src/logconfig.h, src/match.c, src/nafalize.c,
	  src/nafcore.c, src/nafcore.h, src/nafilter.c, src/nafload.c,
	  src/nafscii.c, src/npcap.c, src/nsilk.c, src/rawinput.c,
	  src/rawinput.h, src/renaf.c: Massive source reorganization.
	  Split NAF into applications, libnaf, and libairframe (presently
	  installed with naf but soon to be split into its own
	  distribution). In progress; at this point the rough organization
	  is where it's intended to be but neither the xcode or autotools
	  build systems works yet.

2005-12-06 22:40  Brian Trammell <bht@cert.org>

	* [r2625] configure.in, src/Makefile.am: Build system changes for
	  nafilter, recent nafalize reorg.

2005-12-06 22:28  Brian Trammell <bht@cert.org>

	* [r2624] naf.xcodeproj/project.pbxproj, src/nafalize.c,
	  src/nafilter.c: Add nafilter, a new tool for filtering NAF to
	  NAF. Not yet documented, tested, or added to the Autotools build
	  system; does build in XCode though.

2005-12-06 21:13  Brian Trammell <bht@cert.org>

	* [r2623] naf.xcodeproj/project.pbxproj, src/exparse.c,
	  src/filter.c, src/filter.h, src/lexcore.c, src/lexcore.h: More
	  code churn. Modify expression parsing code to allow filter
	  expression handling outside of nafalize (for nafilter).

2005-12-06 19:42  Brian Trammell <bht@cert.org>

	* [r2622] naf.xcodeproj/project.pbxproj, src/aggregate.c,
	  src/aggregate.h, src/exparse.c, src/exparse.h, src/flowtab.c,
	  src/match.c, src/match.h, src/nafalize.c: Add perimeter biflow
	  support. Add stubs for new split flow table.

2005-12-06 14:40  Brian Trammell <bht@cert.org>

	* [r2621] src/flowtab.c: Remove table-array stub code, as moving
	  to table array is more than a drop-in replacement for the
	  existing flow table. This will be part of a later reorganization
	  of the already hopelessly organic flow table.

2005-12-05 22:19  Brian Trammell <bht@cert.org>

	* [r2620] src/flowtab.c, src/nafalize.c: Begin transition of flow
	  table to table array - this should dramatically increase
	  throughput while providing some memory usage relief in the first
	  stage by replacing the tree with a statically allocated array of
	  hash tables, one per bin.

2005-12-05 20:16  Brian Trammell <bht@cert.org>

	* [r2619] src/exparse.c, src/exparse.h, src/flowtab.c,
	  src/nafalize.c: Add per-output filtering, which appears to work.
	  Move reverse ephemeral mode info aggregation expression. Tweaks
	  to parser and debug output.

2005-12-05 19:06  Brian Trammell <bht@cert.org>

	* [r2618] src/exparse.c, src/exparse.h, src/filter.c,
	  src/filter.h, src/nafalize.c: Add --check-syntax, which parrots
	  back a normalized aggregation expression if the expression
	  parses properly. Fix logic error in rangelist coalesce function,
	  which is now robust to all kinds of rangelist stupidity.

2005-12-05 16:17  Brian Trammell <bht@cert.org>

	* [r2613] src/exparse.c, src/filter.c: Filter debugging. Filtering
	  appears to work, realistically complex rangelists seem to work.
	  Next up is aggregation filter integration.

2005-12-02 21:24  Brian Trammell <bht@cert.org>

	* [r2612] src/flowtab.c: Testing's easier when you can count
	  invocations of the thing you're testing.

2005-12-02 21:22  Brian Trammell <bht@cert.org>

	* [r2611] src/flowtab.c: Heh. Oops. Change filter so it's only
	  evaluated on a miss (otherwise s/d filters won't apply to
	  biflows.)

2005-12-02 21:13  Brian Trammell <bht@cert.org>

	* [r2609] src/nafalize.c: fix missing reveph config - which would
	  actually matter if reveph wasn't an offensive hack itself.

2005-12-02 21:10  Brian Trammell <bht@cert.org>

	* [r2608] src/exparse.c, src/exparse.h, src/flowtab.c,
	  src/flowtab.h, src/nafalize.c: Build checkpoint. Integrate
	  filtering into flowtab. Change flowtab/nafalize interface to
	  make this less ugly. This could be made even _less_ ugly by
	  reorganizing the boundary (which I will do for the libnaf
	  effort). Testing time.

2005-12-02 20:39  Brian Trammell <bht@cert.org>

	* [r2607] src/exparse.c, src/exparse.h, src/filter.c,
	  src/filter.h, src/nafalize.c: Build checkpoint. Replace ad-hoc
	  expression parser and configuration with exparse.c
	  GScanner-based parser. Filter structures are now set up on
	  startup but no filtering has been enabled yet (this will require
	  flowtab changes).

2005-12-02 16:14  Brian Trammell <bht@cert.org>

	* [r2603] naf.xcodeproj/project.pbxproj, src/exparse.c,
	  src/exparse.h, src/nafalize.c: Build checkpoint for new NAF
	  configuration code. Next up is replacing current config in
	  nafalize.c

2005-12-01 22:05  Brian Trammell <bht@cert.org>

	* [r2602] src/airutil.c, src/airutil.h, src/exparse.c,
	  src/filter.h, src/flowtab.c: EOD checkin. Work on expression
	  parser continues. Finished filter range parser, almost finished
	  with aggregation parser. Testing commences tomorrow.

2005-11-30 22:25  Brian Trammell <bht@cert.org>

	* [r2601] src/exparse.c: Expression parser (which still doesn't
	  build) EOD checkin.

2005-11-30 18:10  Brian Trammell <bht@cert.org>

	* [r2598] src/filter.c, src/filter.h: Switch to GArray-based
	  filter implementation (for log(n) performance at filter time).
	  Complete filter implementation, though filters aren't connected
	  yet. Also, filtering is only available on the 5-tuple for now.

2005-11-29 22:37  Brian Trammell <bht@cert.org>

	* [r2597] naf.xcodeproj/project.pbxproj, src/Makefile.am,
	  src/filter.c, src/filter.h: Add null, unused filter
	  implementation.

2005-11-29 22:23  Brian Trammell <bht@cert.org>

	* [r2596] naf.xcodeproj/project.pbxproj, src/flowtab.h,
	  src/rawinput.h: add naf_rawflow_t to rawinput.h (from
	  flowtab.h), where it belongs...

2005-11-29 22:22  Brian Trammell <bht@cert.org>

	* [r2595] naf.xcodeproj/project.pbxproj, src/Makefile.am,
	  src/exparse.c, src/exparse.h: EOD checkin. Begin moving nafalize
	  expression parser from current ad-hoc token stream parser to a
	  GScanner-based recursive descent parser. This is necessary for
	  adding filtering. None of this builds yet, but it's not been
	  added to the build system so all is well.

2005-11-28 20:40  Brian Trammell <bht@cert.org>

	* [r2578] src/flowtab.c, src/nafcore.c, src/nafcore.h: Internal
	  reorganization to support unique port counters, etc. Split
	  tables out from value structure into "VUC" (Value Unique
	  Counter) structure, managed by flowtab.c (since VUC tables exist
	  only at aggregation time). This presently saves four bytes per
	  full flow value; after other counters are added, this will
	  actually start paying off.

2005-11-28 15:29  Brian Trammell <bht@cert.org>

	* [r2565] naf.xcodeproj/project.pbxproj, src/ioconfig.c,
	  src/ioconfig.h: Fix stdin-to-directory case (bug 343).

2005-11-18 00:01  Brian Trammell <bht@cert.org>

	* [r2555] trunk/naf/airdbc/doc/html/airdbc_8h-source.html,
	  trunk/naf/airdbc/doc/html/airdbc_8h.html,
	  trunk/naf/airdbc/doc/html/airdbc__drv_8h-source.html,
	  trunk/naf/airdbc/doc/html/airdbc__drv_8h.html,
	  trunk/naf/airdbc/doc/html/annotated.html,
	  trunk/naf/airdbc/doc/html/files.html,
	  trunk/naf/airdbc/doc/html/functions.html,
	  trunk/naf/airdbc/doc/html/functions_vars.html,
	  trunk/naf/airdbc/doc/html/globals.html,
	  trunk/naf/airdbc/doc/html/globals_defs.html,
	  trunk/naf/airdbc/doc/html/globals_func.html,
	  trunk/naf/airdbc/doc/html/globals_type.html,
	  trunk/naf/airdbc/doc/html/index.html,
	  trunk/naf/airdbc/doc/html/struct___adb_connection.html,
	  trunk/naf/airdbc/doc/html/struct___adb_driver.html,
	  trunk/naf/airdbc/doc/html/struct___adb_result_set.html,
	  trunk/naf/airdbc/doc/html/struct___adb_statement.html,
	  trunk/naf/airdbc/include/airdbc/airdbc.h,
	  trunk/naf/fixbuf/doc/web/index.html, doc/web/index.html,
	  doc/web/nafalize.1.html, doc/web/nafload.1.html,
	  doc/web/nafscii.1.html: Modify website for sourceforge.net file
	  release.

2005-11-17 23:38  Brian Trammell <bht@cert.org>

	* [r2548] NEWS, README, configure.in, doc/Makefile.am,
	  doc/nafalize.1, doc/nafload.1, doc/nafscii.1,
	  doc/web/index.html, doc/web/nafalize.1.html,
	  doc/web/nafload.1.html, doc/web/nafscii.1.html,
	  naf.xcodeproj/project.pbxproj, src/nafload.c: Documentation
	  changes and minor nafload tweak for 0.3.0 release.

2005-11-16 21:34  Brian Trammell <bht@cert.org>

	* [r2533] configure.in, src/nafload.c: Add conditional AirDBC
	  support for nafload. Bring nafload up to AirDBC 0.2.0.

2005-11-16 21:14  Brian Trammell <bht@cert.org>

	* [r2531] src/nafload.c: Remove deprecated AirDBC initialization
	  call.

2005-11-11 18:38  Brian Trammell <bht@cert.org>

	* [r2501] src/ioconfig.c: Giant lock handling fix. Lock handling
	  appears to work now. Tracking down new NAF core bug that makes
	  every other read attempt fail.

2005-11-11 16:51  Brian Trammell <bht@cert.org>

	* [r2500] src/nafload.c: Fix bug in retry logic that required
	  nafload to take a -9 to get the hint about shutdown during
	  connection establishment retry.

2005-11-11 08:20  Brian Trammell <bht@cert.org>

	* [r2499] src/ioconfig.c: Fix bug in fileset name creation
	  uncovered during nafload lock testing. nafload nearing release
	  readiness.

2005-11-10 22:26  Brian Trammell <bht@cert.org>

	* [r2495] src/ioconfig.c, src/ioconfig.h, src/nafalize.c,
	  src/nafload.c: Modify ioconfig and clients to support transient
	  error handling. Add connection failure retry support to nafload
	  dispatcher. Untested as yet.

2005-11-10 21:45  Brian Trammell <bht@cert.org>

	* [r2494] src/nafload.c: Change statistics processing to be more
	  like nafalize. For what it's worth, even using prepared
	  statements and stored procedures, nafload is about 33 times
	  slower than nafalize per flow...

2005-11-10 21:25  Brian Trammell <bht@cert.org>

	* [r2493] src/nafload.c: Fix nafload source ID behavior. Add
	  ability to force source ID at load time. nafload passes initial
	  tests now, and inserts NAF rows into a test postgresql v2
	  database.

2005-11-10 20:25  Brian Trammell <bht@cert.org>

	* [r2491] src/nafload.c: Fix bug in preparing statements at start
	  of dispatch loop.

2005-11-10 09:36  Brian Trammell <bht@cert.org>

	* [r2488] configure.in, naf.xcodeproj/project.pbxproj,
	  src/Makefile.am, src/nafload.c: nafload testing continues. add
	  nafload to autoconf-based build system.

2005-11-09 08:38  Brian Trammell <bht@cert.org>

	* [r2478] src/nafload.c: Minor nafload time handling tweak.

2005-11-09 07:58  Brian Trammell <bht@cert.org>

	* [r2475] naf.xcodeproj/project.pbxproj, src/nafload.c: nafload
	  builds now, ready for test.

2005-11-09 00:48  Brian Trammell <bht@cert.org>

	* [r2472] src/nafload.c: Add core of nafload - builds in XCode
	  except for some Autotools magic.

2005-11-08 08:36  Brian Trammell <bht@cert.org>

	* [r2469] src/ioconfig.c: fix warning in ioc initializer.

2005-11-08 08:32  Brian Trammell <bht@cert.org>

	* [r2468] src/nafload.c: Add nafl_dispatch, nafload dispatch
	  logic, descended from ioconfig. After the 0.3 release, this will
	  have to be rolled back into ioconfig (for, e.g., RDBMS restart
	  and retry capability) for airframe 0.1. Also, actually add
	  nafload (oops).

2005-11-08 02:54  Brian Trammell <bht@cert.org>

	* [r2467] AUTHORS, NEWS, naf.xcodeproj/project.pbxproj,
	  src/ioconfig.c, src/nafscii.c, src/renaf.c: Tweaks for nafload.
	  Add beginnings of nafload - NAF to RDBMS loader. Not yet added
	  to build system.

2005-11-02 22:06  Brian Trammell <bht@cert.org>

	* [r2445] configure.in, doc/nafalize.1, src/flowtab.c,
	  src/nafalize.c, src/nafcore.h: Add ability to choose bin
	  distribution algorithm in aggregate statement. This is NAF 0.2.1.

2005-10-28 14:38  Brian Trammell <bht@cert.org>

	* [r2424] ChangeLog: svn2cl -> ChangeLog.

2005-10-28 14:21  Brian Trammell <bht@cert.org>

	* [r2423] NEWS, README, doc/nafalize.1, doc/nafscii.1,
	  doc/web/index.html, doc/web/nafalize.1.html,
	  doc/web/nafscii.1.html, naf.xcodeproj/project.pbxproj:
	  Documentation in preparation for 0.2.0 release done.

2005-10-27 21:01  Brian Trammell <bht@cert.org>

	* [r2422] README, doc/nafalize.1: Documentation for 0.2.0 release
	  continues.

2005-10-27 20:33  Brian Trammell <bht@cert.org>

        * [r2421] NEWS, README, doc/nafalize.1, src/ioconfig.c: Oops -
          broken build; error in ioconfig standard output error checking.
          Add label append to single output for consistency. Continued
          documentation changes for 0.2.0 in progress.

2005-10-27 19:20  Brian Trammell <bht@cert.org>

        * [r2419] src/flowtab.c, src/ioconfig.c, src/logconfig.c,
          src/nafalize.c: Logging tweaks.

2005-10-27 16:09  Brian Trammell <bht@cert.org>

        * [r2418] configure.in, src/daeconfig.c, src/ioconfig.c: Fix 328 -
          missing NULL encoding on stdout. Version bump to 0.2.0.

2005-10-26 05:42  Brian Trammell <bht@cert.org>

        * [r2416] src/ioconfig.c, src/ioconfig.h, src/nafalize.c,
          src/npcap.c, src/npcap.h: Tearout and rework of live dispatch
          code. This brings up live capture to the standard of the new
          ioc_dispatch code, and most importantly, enables multiple
          aggregation for live capture. Tested against savefile regression
          only - pcap live capture is not guaranteed to work at this point.

2005-10-25 18:58  Brian Trammell <bht@cert.org>

        * [r2414] src/flowtab.c, src/ioconfig.c, src/nafalize.c: Fix
          missing final flush error on single output.

2005-10-25 06:33  Brian Trammell <bht@cert.org>

        * [r2413] src/ioconfig.c, src/ioconfig.h, src/nafalize.c: Correct
          labeling interface discrepancy.

2005-10-25 05:52  Brian Trammell <bht@cert.org>

        * [r2412] src/nafcore.c: Fix (old) typo in nafscii (naf_read).

2005-10-25 00:57  Brian Trammell <bht@cert.org>

        * [r2411] src/ioconfig.c, src/nafalize.c, src/nafcore.h: Multiple
          aggregation appears to work now, and is enabled. Need docs,
          labeling fixes, pcap_live dispatch rework, and more thorough
          regression testing before release version bump.

2005-10-24 23:49  Brian Trammell <bht@cert.org>

        * [r2410] src/ioconfig.c, src/ioconfig.h, src/nafalize.c,
          src/nafscii.c: Integration between IOC and nafalize multiple
          output complete. The only thing keeping this from working now is
          the multiple aggregation "wheel chock" (and any bugs that may be
          lurking behind it).

2005-10-24 19:43  Brian Trammell <bht@cert.org>

        * [r2409] src/flowtab.c, src/flowtab.h, src/nafalize.c: Refactor
          flow table for multiple aggregation. This is the penultimate
          step required for multiple aggregation; next up is integrating
          IOC multiple file support with NAF multiple output channel
          support.

2005-10-24 17:10  Brian Trammell <bht@cert.org>

        * [r2408] src/nafalize.c, src/nafcore.c: Cache masked template IDs
          to avoid collision on multiple output. Continued evolution
          toward fanout support.

2005-10-23 19:34  Brian Trammell <bht@cert.org>

        * [r2406] src/nafalize.c, src/nafcore.h: Array-ify nafalize mask
          and fixbuf writers. Add ability to parse multiple aggregate
          statements in an aggregation expression. Add ability to parse
          labels from aggregation expression (so output files can be named
          something other than -). None of this is yet _connected_, but I
          have done minimal unit testing to avoid regression here.

2005-10-23 14:42  Brian Trammell <bht@cert.org>

        * [r2405] src/argus.c, src/ioconfig.c, src/ioconfig.h,
          src/nafalize.c, src/nafscii.c, src/npcap.c, src/nsilk.c,
          src/renaf.c: Giant ioconfig tearout and rebuild. Add the ability
          for one ioc_file_t to have multiple named channels. This is
          primarily for fanout support (multiple aggregation to multiple
          files) in nafalize. Only multiple output is supported right now.
          Note that there's no actual new functionality here, yet; only
          the internals of ioc_file_t have been changed. Next up is the
          creation of multiple masks, and multiple aggregation tables, in
          nafalize, so we'll have something to write.

2005-10-21 19:59  Brian Trammell <bht@cert.org>

        * [r2404] src/nafscii.c: add no input warning.

2005-10-21 19:23  Brian Trammell <bht@cert.org>

        * [r2401] src/flowtab.c, src/ioconfig.c, src/ioconfig.h,
          src/nafalize.c, src/nafscii.c: Review fixes to ioconfig. Update
          nafscii for new ioconfig.

2005-10-21 13:52  Brian Trammell <bht@cert.org>

        * [r2400] src/flowtab.c, src/ioconfig.c, src/ioconfig.h,
          src/nafalize.c, src/nsilk.c: Complete rework of ioconfig
          dispatch logic. This is largely an internal cleanup effort that
          will pay off later, when we add more exotic input/output
          patterns. Works and passes initial tests, but needs testing of
          failure states. Fix SiLK RW stdin. Fix horizon violation
          detection error on multiple input.

2005-10-19 21:32  Brian Trammell <bht@cert.org>

        * [r2398] configure.in, src/daeconfig.c, src/ioconfig.c,
          src/ioconfig.h, src/logconfig.c, src/nafalize.c: Version bump.
          Reverse --once to --daemon. Nafalize will run as a filter by
          default now. Add single file output to nafalize, though this is
          probably somewhat different (internally) than input/output
          decoupling will look in the next rev of NAF (a lot of this moves
          into ioconfig, which gets cleaned up a bit more). There may be a
          horizon violation detection bug here.

2005-10-17 21:26  Brian Trammell <bht@cert.org>

        * [r2394] src/ioconfig.c, src/nafscii.c, src/npcap.c: Bug fixes -
          fix spurious nafscii EOF, fix missing pcap DLT_EN10MB check.

2005-10-17 20:33  Brian Trammell <bht@cert.org>

        * [r2393] trunk/naf/fixbuf/configure.in,
          trunk/naf/fixbuf/include/fixbuf/rmsg.h,
          trunk/naf/fixbuf/include/fixbuf/wmsg.h,
          trunk/naf/fixbuf/src/rmsg.c, trunk/naf/fixbuf/src/wmsg.c,
          trunk/naf/fixbuf/test/testfixbuf.c, configure.in, src/nafcore.c,
          src/nsilk.c: IPFIX 0.0.9 / NAF 0.1.3 - split IPFIX low-level
          reader/writer drivers into three functions (start, r/w, end) in
          order to support UDP and SCTP backends (for IETF IPFIX interop
          in Vancouver).

2005-10-15 02:21  Brian Trammell <bht@cert.org>

        * [r2392] src/ioconfig.c: Fix standard input and output. Pipes
          work now.

2005-10-14 20:39  Brian Trammell <bht@cert.org>

        * [r2391] src/ioconfig.c: Fix binary standard output

2005-10-14 19:30  Brian Trammell <bht@cert.org>

        * [r2390] configure.in, doc/nafalize.1, src/Makefile.am,
          src/nafcore.c: NAF 0.1.2 version bump. Autotools stuff for renaf.

2005-10-14 18:31  Brian Trammell <bht@cert.org>

        * [r2389] src/nafcore.c: Fix sipmask defaulting (bug exposed
          during renaf testing)

2005-10-14 13:47  Brian Trammell <bht@cert.org>

        * [r2386] src/nafalize.c, src/nafcore.c, src/renaf.c: renaf driver
          fixes, update to libfixbuf 0.0.8 API. renaf does _not_ aggregate
          properly, but it doesn't crash anymore, either, so that's
          something.

2005-10-12 21:29  Brian Trammell <bht@cert.org>

        * [r2378] naf.xcodeproj/project.pbxproj, src/renaf.c, src/renaf.h:
          Add renaf - NAF input driver. Builds, not yet tested.

2005-10-11 21:38  Brian Trammell <bht@cert.org>

	* [r2359] src/flowtab.c, src/nafalize.c: Horizon violation,
	  horizon selection, and flush timing enhancements.

2005-10-11 19:07  Brian Trammell <bht@cert.org>

	* [r2355] doc/nafalize.1, doc/nafscii.1, src/flowtab.c,
	  src/nafcore.c, src/nafcore.h, src/nafscii.c, src/npcap.c,
	  src/nsilk.c: Big Ole Pile O' NAF Bugfixes: Fix flow count
	  reversal typo.  Flow counts in PCAP (and, presumably, elsewhere)
	  work now. Fix host count reversal typo. Host counts work
	  now. Fix minor SiLK input driver bug. SiLK input driver testing
	  continues.

2005-10-10 20:22  Brian Trammell <bht@cert.org>

	* [r2350] src/npcap.c: Fragment reassembly works now. There still
	  seem to be issues with SYN-based flow counting.

2005-10-10 18:36  Brian Trammell <bht@cert.org>

	* [r2347] src/flowtab.c, src/npcap.c: Flow table statistics
	  streamline. Add pcap fragment reassembler. Build checkpoint;
	  testing continues.

2005-10-07 19:35  Brian Trammell <bht@cert.org>

	* [r2340] naf.xcodeproj/project.pbxproj, src/flowtab.c,
	  src/nafalize.c, src/npcap.c, src/npcap.h: Hooks in pcap driver
	  for as-yet-unwritten fragment reassembler. Add SYN-as-flow count
	  to pcap driver. Modify flowtab to track flow table size (instead
	  of relying on recursive GTree node count). This is necessary to
	  help debug spurious flush events. Minor changes to flow table
	  statistics.

2005-10-07 15:45  Brian Trammell <bht@cert.org>

	* [r2337] configure.in, src/nsilk.c: Save some warnings (due to
	  silk config.h), silk driver builds. Now all I need is some silk
	  data to test with. Until then, moving on...

2005-10-07 15:09  Brian Trammell <bht@cert.org>

	* [r2336] configure.in, src/Makefile.am, src/nsilk.c, src/nsilk.h:
	  Continued attempts to get SiLK driver building - unsuccessful as
	  yet, due to symbol collision between NAF and SiLK config.h files.

2005-10-06 21:10  Brian Trammell <bht@cert.org>

	* [r2335] configure.in, naf.xcodeproj/project.pbxproj,
	  src/Makefile.am, src/argus.c, src/autoinc.h, src/nafalize.c,
	  src/npcap.c, src/npcap.h, src/nsilk.c: EOD commit - SiLK driver
	  object dependencies and cflags are broken because automake
	  sucks. SiLK driver is also probably broken of its own accord. To
	  avoid the pain, simply don't tell ./configure you want SiLK.

2005-10-06 19:42  Brian Trammell <bht@cert.org>

	* [r2334] src/nsilk.c, src/nsilk.h: Add (not yet building or
	  functional) SiLK input driver.

2005-10-04 18:26  Brian Trammell <bht@cert.org>

	* [r2323] INSTALL, doc/Makefile.am, src/Makefile.am: Continued
	  make dist target bug golf. Add INSTALL file for GNU hapiness.

2005-10-04 18:11  Brian Trammell <bht@cert.org>

	* [r2322] configure.in, src/Makefile.am: Autotools build system
	  fixes.

2005-10-04 14:39  Brian Trammell <bht@cert.org>

	* [r2300] .: Move air3/naf to naf/tools.

2005-10-03 19:47  Brian Trammell <bht@cert.org>

	* [r2294] COPYING, ChangeLog, NEWS, README, configure.in,
	  doc/nafalize.1, src/nafalize.c: SVN synchronization for
	  Monday. Bump NAF version and libfixbuf documentation. Trivial
	  change to NAF aggregation expression syntax. Documentation
	  changes for NAF 0.1.0 release.

2005-10-03 15:30  Brian Trammell <bht@cert.org>

	* [r2293] doc/ietf/draft-trammell-ipfix-file-01.xml,
	  doc/nafalize.1, doc/nafscii.1, naf.xcodeproj/project.pbxproj,
	  src/nafalize.c: SVN sync of Friday's work.  - Rev 01 of IPFIX
	  File draft - Change nafalize command line args for ease of use
	  and documentation

2005-09-29 13:55  Brian Trammell <bht@cert.org>

	* [r2283] configure.in, doc/nafalize.1, doc/nafscii.1,
	  src/Makefile.am, src/flowtab.c, src/nafalize.c, src/nafcore.c,
	  src/nafcore.h, src/nafscii.c: Sixth time's a charm. Add distinct
	  source and destination host counts on aggregation.

2005-09-28 19:37  Brian Trammell <bht@cert.org>

	* [r2279] doc/nafalize.1, src/nafalize.c, src/nafcore.h,
	  src/npcap.c, src/npcap.h: Mature live capture support.
	  --pcap-live mode is now explicit, instead of being hacked into
	  --in mode. Add separate codepath for live capture to allow for
	  output file rotation. Add hooks to core flow values for host
	  counting. Add host counting option, without actual support.

2005-09-27 22:09  Brian Trammell <bht@cert.org>

	* [r2269] configure.in, doc/nafalize.1, src/ioconfig.c,
	  src/ioconfig.h, src/nafalize.c, src/nafscii.c, src/npcap.c:
	  ioconfig changes: add handler context to IOC dispatch. This
	  isn't used yet, but 1) it should be there and 2) it looked like
	  it might be during development of the pcap stuff below, so why
	  not leave it in? Also add ability for applications to peek at
	  inspec and outspec before IOC dispatch, as a hook to hack in
	  special file handling for special (non-URL) strings. This
	  support _should_ be replaced with real ioc_url_t support, but I
	  wanted to get NAF live capture out the door quickly. Add
	  nafalize live capture support. Hack. The special input specifier
	  pcap:ifname will create a file names ifname.naf containing pcap
	  flows aggregated live off the wire.  Whee.

2005-09-27 20:35  Brian Trammell <bht@cert.org>

	* [r2268] src/flowtab.c, src/flowtab.h, src/nafalize.c,
	  src/nafcore.c, src/nafcore.h, src/nafscii.c: Modify nafcore to
	  no longer use static fixbuf readers and writers. Add ability to
	  get nafcore ipfix session. Both of these are for a naf input
	  driver.

2005-09-27 20:09  Brian Trammell <bht@cert.org>

	* [r2267] src/ioconfig.c, src/ioconfig.h: Inconsequential ioconfig
	  tweaks.

2005-09-27 19:34  Brian Trammell <bht@cert.org>

	* [r2266] src/flowtab.c, src/nafalize.c: Short-circuit unnecessary
	  flushes and flow table size checks. Extreme (~100x) speedup on
	  large (~1m entry) flow tables. Thanks, Shark!

2005-09-27 15:00  Brian Trammell <bht@cert.org>

	* [r2265] src/nafscii.c: Fix counter header print bug in nafscii.

2005-09-27 14:43  Brian Trammell <bht@cert.org>

	* [r2264] configure.in, doc/nafalize.1,
	  naf.xcodeproj/project.pbxproj, src/argus.c, src/npcap.c: Add
	  missing non-IP packet skip to pcap driver. Add ethernet header
	  adjustment to octet count for argus2 driver.

2005-09-27 02:10  Brian Trammell <bht@cert.org>

	* [r2263] src/Makefile.am, src/argus.c, src/argus.h,
	  src/autoinc.h, src/ioconfig.c, src/ioconfig.h, src/nafalize.c,
	  src/nafcore.h, src/npcap.c, src/npcap.h, src/rawinput.c,
	  src/rawinput.h: Add pcap driver, and change driver MPI to
	  accomodate. Builds. Needs test.

2005-09-26 18:50  Brian Trammell <bht@cert.org>

	* [r2262] configure.in, src/Makefile.am: Fix source makefile to
	  find libfixbuf. Add doc makefile to configure.

2005-09-26 18:27  Brian Trammell <bht@cert.org>

	* [r2260] Makefile.am, NEWS, doc/nafalize.1, doc/nafscii.1,
	  naf.xcodeproj/project.pbxproj, src/argus.c, src/nafalize.c:
	  Change argus driver name to argus2. Add nafalize, nafscii man
	  pages.

2005-09-23 18:24  Brian Trammell <bht@cert.org>

	* [r2257] naf.xcodeproj/project.pbxproj, src/flowtab.c,
	  src/nafcore.c, src/nafscii.c: NAF binning fixes
	  (apparently forgot to change binning algorithm in one place).
	  NAF flow reversal fixes. nafalize/nafscii now passes unit tests.
	  More extensive testing and documentation will be necessary
	  before general release, but this is for all intents and purposes
	  done.

2005-09-21 21:41  Brian Trammell <bht@cert.org>

	* [r2256] naf.xcodeproj/project.pbxproj, src/ioconfig.c,
	  src/nafscii.c: fix read status bug

2005-09-21 18:25  Brian Trammell <bht@cert.org>

	* [r2251] src/nafalize.c, src/nafcore.c, src/nafscii.c: nafalize
	  bugfixes.

2005-09-21 15:51  Brian Trammell <bht@cert.org>

	* [r2249] configure.in, src/nafscii.c: nafscii build checkpoint.
	  NAF 0.0.4 functionally complete. Testing begins.

2005-09-21 15:26  Brian Trammell <bht@cert.org>

	* [r2248] src/argus.c, src/flowtab.c, src/flowtab.h,
	  src/nafalize.c, src/nafcore.c, src/nafcore.h: nafalize build
	  checkpoint - new NAF core changes are now available in
	  nafalize. Not yet tested.

2005-09-20 21:51  Brian Trammell <bht@cert.org>

	* [r2247] naf.xcodeproj/project.pbxproj, src/airutil.c,
	  src/airutil.h, src/argus.c, src/autoinc.h, src/flowtab.c,
	  src/flowtab.h, src/ioconfig.c, src/ioconfig.h, src/nafalize.c,
	  src/nafcore.c, src/nafcore.h, src/nafscii.c: Intermediate (EOD)
	  checkpoint. Add fixbuf support. This does not yet build.

2005-09-19 20:25  Brian Trammell <bht@cert.org>

	* [r2243] AUTHORS, src/nafcore.c: Beginnings of libfixbuf based
	  NAF. Doesn't build.

2005-08-30 21:04  Brian Trammell <bht@cert.org>

	* [r2161] src/argus.c: Irrelevant NAF source tweaks.
	  Add initial libfixbuf, buffer-based IPFIX implementation. This
	  dreams of one day building, but for now it's just a source code
	  outline and a proposal for what data structures should look like.

2005-08-29 20:13  Brian Trammell <bht@cert.org>

	* [r2158] src/daeconfig.c, src/ioconfig.c: Test checkpoint. NAF
	  daemon mode works now.

2005-08-29 17:12  Brian Trammell <bht@cert.org>

	* [r2157] configure.in, src/Makefile.am, src/airutil.h,
	  src/autoinc.h: Finished autoconf hacks for handling static
	  glib. Builds on SAFARIzed linux boxen now. Add newlines to some
	  header files, to fix gcc warnings that didn't show up on the
	  Mac.

2005-08-26 20:08  Brian Trammell <bht@cert.org>

	* [r2153] configure.in, src/flowtab.c, src/flowtab.h,
	  src/nafalize.c: Initial --reverse-ephemeral support. Treats
	  well-known, 8080, 8888, 6667, and 6668 as services; uses
	  ephemeral port definition from ncftp docs. Modify glib autoconf
	  support to actually verify that the installed glib works.

2005-08-26 05:42  Brian Trammell <bht@cert.org>

	* [r2152] src/airutil.c, src/flowtab.c, src/nafscii.c: Fix zero
	  source flow count bug. Minor logging fixes.

2005-08-26 04:47  Brian Trammell <bht@cert.org>

	* [r2151] src/airutil.c, src/flowtab.c: Fix log buffer
	  typobug. Fix miscellaneous bugs in matching (which appears to
	  work now) - the high density of high ports in the test data
	  appears in the argus flow data, as well, so I'm not sure what's
	  up there. More debugging will probably involve me stepping
	  through the test data with ra, which it's too late for now.

2005-08-25 22:07  Brian Trammell <bht@cert.org>

	* [r2150] src/flowtab.c, src/flowtab.h, src/nafalize.c,
	  src/nafscii.c: Move to split match/aggregate tables in
	  nafalize. All is not quite well - for some reason, there exist
	  flow records with source and destination flow counts of zero,
	  which is clearly a bug, and the source/destination flow matching
	  may not actually work yet either (still seeing a LOT of
	  ephemeral dports). Will do more rigorous testing tomorrow to
	  attempt to isolate these bugs.

2005-08-25 14:46  Brian Trammell <bht@cert.org>

	* [r2149] naf.xcodeproj/project.pbxproj, src/flowtab.c,
	  src/nafscii.c: nafalize is now properly writing flow
	  values. Minor nafscii tweaks.

2005-08-25 12:56  Brian Trammell <bht@cert.org>

	* [r2148] naf.xcodeproj/project.pbxproj, src/ioconfig.c,
	  src/ioconfig.h, src/nafalize.c, src/nafscii.c: Fix 269 and 270;
	  fix issues with ioc_write not supporting length -1 (for
	  strlen). Nafscii works now, and has illustrated a bug in
	  nafcore's write routines.

2005-08-23 21:54  Brian Trammell <bht@cert.org>

	* [r2147] naf.xcodeproj/project.pbxproj, src/airutil.c,
	  src/airutil.h, src/argus.c, src/flowtab.c, src/ioconfig.c,
	  src/ioconfig.h, src/logconfig.c, src/nafalize.c, src/nafcore.c,
	  src/nafcore.h, src/nafscii.c: nafscii build checkpoint.  For
	  some reason, header reads return all zeroes. This makes reading
	  naf records problematic. I'll probably give up on fixing bugs in
	  the I/O code before reorganizing it to comply with
	  draft-trammell-ipfix-file-01 (which I'll do tomorrow morning).
	  Fix bug in nafcore which made headers declaring lengths less
	  than 4 segfault. XCode project tweaks for nafscii.

2005-08-23 18:47  Brian Trammell <bht@cert.org>

	* [r2146] naf.xcodeproj/project.pbxproj, src/airutil.c,
	  src/airutil.h, src/autoinc.h, src/ioconfig.c, src/logconfig.c,
	  src/nafscii.c: Modified timestamp code to be more
	  usable. Nafscii in progress. Tweak autoinc to improve
	  buildability on Linux.

2005-08-23 15:13  Brian Trammell <bht@cert.org>

	* [r2145] doc, doc/ietf,
	  doc/ietf/draft-trammell-ipfix-file-01.xml,
	  naf.xcodeproj/project.pbxproj, src/argus.c, src/nafalize.c,
	  src/nafcore.c: Fix EOF promotion bug.  Never forget that C's de
	  facto precedence order is parenthesis-based. Debug code
	  removal. Add IETF draft describing the IPFIX optimization NAF
	  does not quite yet use to doc directory.

2005-08-22 19:58  Brian Trammell <bht@cert.org>

	* [r2144] naf.xcodeproj/project.pbxproj, src/argus.c,
	  src/flowtab.c, src/flowtab.h, src/ioconfig.c, src/nafalize.c,
	  src/nafcore.c: Mid-debug checkin. Table flush works
	  now. Termination condition works now. Both were logic
	  errors. There does seem to be a magic promotion of EOF to I/O
	  error, which makes all input files magically fail; working on
	  fixing this, then we can start actual testing.

2005-08-19 20:38  Brian Trammell <bht@cert.org>

	* [r2143] naf.xcodeproj, naf.xcodeproj/project.pbxproj,
	  src/Makefile.am, src/airutil.c, src/airutil.h, src/argus.c,
	  src/ioconfig.c, src/ioconfig.h, src/logconfig.c,
	  src/logconfig.h, src/nafalize.c, src/nafcore.c, src/nafcore.h,
	  src/nafscii.c, src/rawinput.c, src/rawinput.h: EOD checkin. Add
	  nafscii core logic (twenty more lines of code and it'll actually
	  do what it says). nafalize flow table logic works but loop
	  termination conditions are a little broken, and nothing appears
	  in output yet. Add nafscii to automake - build untested. Add
	  XCode project file for parallel build system.

2005-08-19 04:55  Brian Trammell <bht@cert.org>

	* [r2142] src/ioconfig.c, src/ioconfig.h, src/nafalize.c: nafalize
	  logic (dispatch) complete and ready for testing.

2005-08-18 21:27  Brian Trammell <bht@cert.org>

	* [r2141] src/Makefile.am, src/airutil.c, src/airutil.h,
	  src/daeconfig.c, src/ioconfig.c, src/ioconfig.h,
	  src/logconfig.c, src/logconfig.h, src/nafcore.c: Add timestamp
	  utility functions. Fix logging bugs and GCC unused attribute
	  timestamp errors.

2005-08-18 20:14  Brian Trammell <bht@cert.org>

	* [r2140] src/autoinc.h, src/daeconfig.c, src/daeconfig.h,
	  src/ioconfig.c, src/logconfig.c, src/nafalize.c, src/nafcore.h:
	  Debugging flowtable and I/O setup code. Periodic
	  checkpoint. Builds perfectly but does not run.

2005-08-18 15:50  Brian Trammell <bht@cert.org>

	* [r2139] src/daeconfig.h, src/ioconfig.c, src/nafcore.c: Fixed
	  warnings. null nafalize builds cleanly now.

2005-08-17 21:54  Brian Trammell <bht@cert.org>

	* [r2138] configure.in, src/Makefile.am: Fix automake system.
	  nafalize now builds with its own build system, though there are
	  still warnings in a couple of source files.

2005-08-17 21:36  Brian Trammell <bht@cert.org>

	* [r2137] AUTHORS, NEWS, src/argus.c, src/argus.h, src/autoinc.h,
	  src/daeconfig.c, src/daeconfig.h, src/flowtab.c, src/flowtab.h,
	  src/ioconfig.c, src/ioconfig.h, src/logconfig.c,
	  src/logconfig.h, src/nafalize.c, src/nafcore.c, src/nafcore.h,
	  src/rawinput.c, src/rawinput.h: Build checkpoint. A version of
	  nafalize capable of parsing its own configuration file
	  successfully builds with an external build system.

2005-08-16 21:53  Brian Trammell <bht@cert.org>

	* [r2133] Makefile.am, configure.in, src/Makefile.am,
	  src/nafalize.c: Assuming the existence of magic, this autoconf
	  fu will work. Otherwise, it's back to raiding the corpses of
	  other open source build systems.

2005-08-16 19:54  Brian Trammell <bht@cert.org>

	* [r2132] Makefile, format.txt, naf.c, src/daeconfig.c,
	  src/ioconfig.c, src/logconfig.c, src/nafalize.c: Preparation for
	  initial build (configuration test) - tearout old code and
	  makefiles for autoconfiscability.

2005-08-16 15:12  Brian Trammell <bht@cert.org>

	* [r2125] src/nafalize.c: Add nafalize main file.

2005-08-15 22:11  Brian Trammell <bht@cert.org>

	* [r2124] src/daeconfig.c, src/ioconfig.c, src/ioconfig.h,
	  src/logconfig.c: NAF work continues.  Generic dispatch loop
	  complete, in spirit anyway. Next up: actually trying to built an
	  app (nafalize) from these here parts.

2005-08-12 23:17  Brian Trammell <bht@cert.org>

	* [r2123] src/ioconfig.c, src/ioconfig.h: Input and output file
	  routing complete. Next up - more transparent standard I/O
	  handling, standard dispatch.

2005-08-11 21:59  Brian Trammell <bht@cert.org>

	* [r2122] src/ioconfig.c: move to a dispatch-based architecture
	  for IOC input file processing. IOC work continues.

2005-08-11 20:00  Brian Trammell <bht@cert.org>

	* [r2121] src/daeconfig.c, src/daeconfig.h, src/ioconfig.c,
	  src/logconfig.c, src/logconfig.h: part of the ugliness with
	  ioconfig was that it was doing non-orthogonal, non-IO-related
	  things. Fix this by splitting daemonization and logging out into
	  their own configuration modules. Next up, steal the logic from
	  filerouter.

2005-08-10 21:28  Brian Trammell <bht@cert.org>

	* [r2119] src/ioconfig.c, src/ioconfig.h: Finish logging. Working
	  on input. Need to go back to the drawing board a bit on the API
	  here... what I designed in Paris isn't quite as flexible as
	  we'll need...

2005-08-09 21:34  Brian Trammell <bht@cert.org>

	* [r2118] src/argus.c, src/ioconfig.c, src/ioconfig.h:
	  ioconfig (new glib based filerouter) for NAF is nearing
	  completion. Mainly working on arg parsing stuff at the
	  moment (most of the actual logic can be stolen from filerouter
	  itself).

2005-08-03 17:14  Brian Trammell <bht@cert.org>

	* [r2113] src/ioconfig.c, src/ioconfig.h: Add initial ioconfig -
	  this will replace filerouter and part of the log setup
	  functionality for NAF and future Glib apps.

2005-08-01 13:19  Brian Trammell <bht@cert.org>

	* [r2112] src/argus.c, src/argus.h, src/nafcore.c, src/rawinput.h:
	  add Argus driver.

2005-08-01 10:04  Brian Trammell <bht@cert.org>

	* [r2111] src/rawinput.c, src/rawinput.h: Add initial driver layer
	  glue.

2005-08-01 08:58  Brian Trammell <bht@cert.org>

	* [r2110] src/flowtab.c: finish NAF flow table primitive support
	  implementation.

2005-07-28 18:58  Brian Trammell <bht@cert.org>

	* [r2106] src/flowtab.c, src/flowtab.h: After a long afternoon of
	  redesigning the flowtable flush mechanism twice, realize that
	  the way it was in the prototype is probably fine for any
	  foreseeable application of the flowtab structure in the three
	  NAF applications designed so far. Stub out new flowtable flush
	  functionality, based on cleaned up prototype code.

2005-07-26 21:13  Brian Trammell <bht@cert.org>

	* [r2105] src/flowtab.c, src/flowtab.h, src/nafcore.h: Flow table 
      work - everything but flush is there now.

2005-07-25 20:38  Brian Trammell <bht@cert.org>

	* [r2104] src/nafcore.c, src/nafcore.h: NAF read/write support
	  complete.

2005-07-25 14:01  Brian Trammell <bht@cert.org>

	* [r2103] src/nafcore.c: d'oh - fix missing byte order stuff.

2005-07-25 13:56  Brian Trammell <bht@cert.org>

	* [r2102] src/nafcore.c: NAF IPFIX record output implementation
	  complete.

2005-07-22 21:15  Brian Trammell <bht@cert.org>

	* [r2101] format.txt, src/nafcore.c, src/nafcore.h: Add NAF core
	  read and write routines (from yesterday's IPFIX exercise...)

2005-07-08 21:25  Brian Trammell <bht@cert.org>

	* [r2098] src, src/flowtab.c, src/flowtab.h, src/nafcore.c,
	  src/nafcore.h: Beginning of refactoring into NAF as real
	  application. Split sources and move to src/ dir for
	  autoconfiscation.

