- Rewrite DNS resolution code
  - "Lazy" resolution
  - Asynch resolution

- Get rid of kludgieness in referencing of peer records

- More datalink types (esp Token ring, FDDI and SLIP)

- More analysis modes
 - Per protocol (TCP/UDP/ICMP)
 - Per service (HTTP/SMTP/SMB/etc)
 - Per protocol/service per host
 - Per protocol/service per src/dest pair
 - TCP connection tracking
 - Packet size histogram
 - Traffic vs time (global)
 - Traffic vs time (per-host)
 - Traffic vs time (per-service)
 - Local vs remote traffic

- Modular analysis modes (dynamically loadable?)

- Realtime monitoring

- More sort modes

- Frontends
 - text (done)
 - HTML (done)
 - GNU plotutils (for postscript, fig, etc) *or* G2 graphics library
 - X (probably using GTK and OpenGL)

- Seperate data collector and frontend

- X frontend should have ability to start tcpdump on a host or src/dest 
  pair

- Protocols other than IP

- Save/restore state
