% $Header: /home/jaguar/u0/vern/bro/bro-doc/RCS/todo.tex,v 1.13 2002/11/16 01:26:03 vern Exp $

\labsectchapter{{Missing Documentation}}{\label{todo}}
%HEVEA\cutdef[1]{section}

This chapter holds stubs for subjects that have yet to be documented.
Some of these are actually already somewhat covered elsewhere in the
manual.  In addition, a major missing piece for the manual is the
Bro language itself; below we mention some Bro language topics that
come up elsewhere in the current version of the manual.

\labsectsection{{ The use of \emph{prefixes} }}{\label{prefixes}}
~

\labsectsection{{ The tcpdump save file that Bro writes }}{\label{write-file} \label{trace-log}}
~

\section{ The {\tt bro.init} initialization file }
~

\section{ Assignment operators such as {\tt +=} }	%###
~

\labsectsection{{ The notion of redefinition/refinement }}{\label{redef} \label{refinement}}
~

\section{ The logging model }
~

\labsectsection{{ Timer management }}{\label{timer-management}}
~

\labsectsection{{ SYN-FIN filtering }}{\label{syn-fin-filtering}}
~

\labsectsection{{ Split routing }}{\label{split-routing}}
~

\labsectsection{{ Scan dropping }}{\label{scan-dropping}}
~

\labsectsection{{ Operator precedence }}{\label{precedence}}
~

\labsectsection{{ Partial connections }}{\label{partial-connection}}
~

\labsectsection{{ Packet drops }}{\label{packet-drops}}
~

\labsectsection{{ The \load directive }}{\label{load-directive}}
~

\labsectsection{{ Global statements }}{\label{global-stmts}}
~

\labsectsection{{ Inserting tables into tables }}{\label{inserting-tables-into-tables}}
~

\labsectsection{{ Demultiplexing }}{\label{demux}}
~

\labsectsection{{ Bro init file }}{\label{bro-init-file}}
~

\labsectsection{{ Hostnames vs. addresses }}{\label{hostnames-vs-addresses}}
~

\labsectsection{{ The hot-report script }}{\label{hot-report-script}}
~

\section{ Use of libpcap/BPF }
\cite{bpf,pcap}
~

\section{ The problem of evasion }
\cite{ptacek98}
~

\section{ Backscatter }
~

\labsectsection{{ Playing back traces }}{\label{play-back}}
~

\labsectsection{{ Discarders }}{\label{discarders}}
~

\labsectsection{{ Differences between this release and the previous one }}{\label{differences}}
~

\section{ Alert cascade }
~

\section{ The need for subtyping }
~

E.g., {\tt src addr} vs. {\tt dst addr}, perhaps
using attributes.
~

\section{ The need for CIDR masks }
~

\section{ The wish list }
~

\section{ Known bugs }
~

%HEVEA\cutend

