diff --git a/CHANGES b/CHANGES
index aff232a9b7..449b5c9eb4 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,27 @@
+1.6-dev.99 Fri Apr 22 22:10:03 PDT 2011
+
+- Extending the connection record with a unique identifier. (Robin
+  Sommer)
+
+    type connection: record {
+        [...]
+        id: string;
+   };
+
+  These identifiers very likely unique even across independent Bro
+  runs.
+
+- Delete operator for record fields. (Robin Sommer)
+    
+  "delete x$y" now resets record field "x" back to its original state
+  if it is either &optional or has a &default. "delete" may not be
+  used with non-optional/default fields.
+
+- Fixing bug with nested record coercions. (Robin Sommer)
+
+- Fixing a do_split() bug. (Seth Hall)
+
+
 1.6-dev.94 Thu Apr 21 19:51:38 PDT 2011
 
 - Fixing generation of config.h. (Jon Siwek)
diff --git a/Makefile b/Makefile
index d2620b422c..77f0626cdc 100644
--- a/Makefile
+++ b/Makefile
@@ -23,13 +23,13 @@ install: configured
 
 clean: configured
 	( cd $(BUILD) && make clean )
-	( cd $(BUILD) && make doc-clean )
+	( cd $(BUILD) && make docclean && make restclean )
 
 doc: configured
 	( cd $(BUILD) && make doc )
 
-doc-clean: configured
-	( cd $(BUILD) && make doc-clean )
+docclean: configured
+	( cd $(BUILD) && make docclean && make restclean )
 
 dist: cmake_version
 	# Minimum Bro source package
diff --git a/VERSION b/VERSION
index 110b0b440a..359249d5d6 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.6-dev.94
+1.6-dev.99
diff --git a/aux/binpac b/aux/binpac
index 43994f50b3..4fc13f7c69 160000
--- a/aux/binpac
+++ b/aux/binpac
@@ -1 +1 @@
-Subproject commit 43994f50b320ff9e1d129b87bbe3a26dbfb3e33d
+Subproject commit 4fc13f7c6987b4163609e3df7a31f38501411cb7
diff --git a/aux/bro-aux b/aux/bro-aux
index 3ec53f69fd..14a7cfe4ea 160000
--- a/aux/bro-aux
+++ b/aux/bro-aux
@@ -1 +1 @@
-Subproject commit 3ec53f69fd45d8e2c0950dc0e7af117bb3e02c0d
+Subproject commit 14a7cfe4ea2ff6c7f5301dcb81a869adcd6e9834
diff --git a/aux/broccoli b/aux/broccoli
index 9c5d8c8824..8843da57dc 160000
--- a/aux/broccoli
+++ b/aux/broccoli
@@ -1 +1 @@
-Subproject commit 9c5d8c882411dc26de8ef92ff5d77b524b9d48ee
+Subproject commit 8843da57dc8aee433550727dcbd1199824ca9da4
diff --git a/aux/broctl b/aux/broctl
index 7f33745957..1bf5407722 160000
--- a/aux/broctl
+++ b/aux/broctl
@@ -1 +1 @@
-Subproject commit 7f337459574d027559e419219e83c65d8a6e1c23
+Subproject commit 1bf5407722ef5910bafd513bcec6a51b280eeb10
diff --git a/aux/btest b/aux/btest
index aee56f4632..f096c0e408 160000
--- a/aux/btest
+++ b/aux/btest
@@ -1 +1 @@
-Subproject commit aee56f4632c9a4224727da1b535b673a4bcb5d3b
+Subproject commit f096c0e4088f2d92743e0c28077f086dff216cce
diff --git a/cmake/ConfigurePackaging.cmake b/cmake/ConfigurePackaging.cmake
index f77dcc0fae..6d7cb3d76f 100644
--- a/cmake/ConfigurePackaging.cmake
+++ b/cmake/ConfigurePackaging.cmake
@@ -63,10 +63,7 @@ endmacro(SetPackageVersion)
 #
 # Darwin - PackageMaker
 # Linux - RPM if the platform has rpmbuild installed
-#         DEB is ommitted because CPack does not give enough
-#         control over how the package is created and lacks support
-#         for automatic dependency detection.
-#         
+#         DEB if the platform has dpkg-shlibdeps installed
 #
 # CPACK_GENERATOR is set by this macro
 # CPACK_SOURCE_GENERATOR is set by this macro
@@ -77,9 +74,14 @@ macro(SetPackageGenerators)
         list(APPEND CPACK_GENERATOR PackageMaker)
     elseif (${CMAKE_SYSTEM_NAME} MATCHES "Linux")
         find_program(RPMBUILD_EXE rpmbuild)
+        find_program(DPKGSHLIB_EXE dpkg-shlibdeps)
         if (RPMBUILD_EXE)
             set(CPACK_GENERATOR ${CPACK_GENERATOR} RPM)
         endif ()
+        if (DPKGSHLIB_EXE)
+            set(CPACK_GENERATOR ${CPACK_GENERATOR} DEB)
+            set(CPACK_DEBIAN_PACKAGE_SHLIBDEPS true)
+        endif ()
     endif ()
 endmacro(SetPackageGenerators)
 
@@ -159,11 +161,27 @@ macro(SetPackageInstallScripts VERSION)
     endif ()
 
     if (${CMAKE_SYSTEM_NAME} MATCHES "Linux")
+        # DEB packages can automatically handle configuration files
+        # if provided in a "conffiles" file in the packaging
+        set(conffiles_file ${CMAKE_CURRENT_BINARY_DIR}/conffiles)
+        if (INSTALLED_CONFIG_FILES)
+            string(REPLACE " " ";" conffiles ${INSTALLED_CONFIG_FILES})
+        endif ()
+        file(WRITE ${conffiles_file} "")
+        foreach (_file ${conffiles})
+            file(APPEND ${conffiles_file} "${_file}\n")
+        endforeach ()
+
+        list(APPEND CPACK_DEBIAN_PACKAGE_CONTROL_EXTRA
+            ${CMAKE_CURRENT_BINARY_DIR}/conffiles)
+
+        # RPMs don't need any explicit direction regarding config files.
+
         # Leaving the set of installed config files empty will just
-        # bypass the logic in the pre/post install scripts and let
-        # the RPM do their own thing (regarding backups, etc.)
+        # bypass the logic in the default pre/post install scripts and let
+        # the RPMs/DEBs do their own thing (regarding backups, etc.)
         # when upgrading packages.
-        set (INSTALLED_CONFIG_FILES "")
+        set(INSTALLED_CONFIG_FILES "")
     endif ()
 
     if (EXISTS ${CMAKE_CURRENT_SOURCE_DIR}/cmake/package_preinstall.sh.in)
@@ -171,10 +189,16 @@ macro(SetPackageInstallScripts VERSION)
             ${CMAKE_CURRENT_SOURCE_DIR}/cmake/package_preinstall.sh.in
             ${CMAKE_CURRENT_BINARY_DIR}/package_preinstall.sh
             @ONLY)
+        configure_file(
+            ${CMAKE_CURRENT_SOURCE_DIR}/cmake/package_preinstall.sh.in
+            ${CMAKE_CURRENT_BINARY_DIR}/preinst
+            @ONLY)
         set(CPACK_PREFLIGHT_SCRIPT
             ${CMAKE_CURRENT_BINARY_DIR}/package_preinstall.sh)
         set(CPACK_RPM_PRE_INSTALL_SCRIPT_FILE
             ${CMAKE_CURRENT_BINARY_DIR}/package_preinstall.sh)
+        list(APPEND CPACK_DEBIAN_PACKAGE_CONTROL_EXTRA
+            ${CMAKE_CURRENT_BINARY_DIR}/preinst)
     endif ()
 
     if (EXISTS ${CMAKE_CURRENT_SOURCE_DIR}/cmake/package_postupgrade.sh.in)
@@ -182,10 +206,16 @@ macro(SetPackageInstallScripts VERSION)
             ${CMAKE_CURRENT_SOURCE_DIR}/cmake/package_postupgrade.sh.in
             ${CMAKE_CURRENT_BINARY_DIR}/package_postupgrade.sh
             @ONLY)
+        configure_file(
+            ${CMAKE_CURRENT_SOURCE_DIR}/cmake/package_postupgrade.sh.in
+            ${CMAKE_CURRENT_BINARY_DIR}/postinst
+            @ONLY)
         set(CPACK_POSTUPGRADE_SCRIPT
             ${CMAKE_CURRENT_BINARY_DIR}/package_postupgrade.sh)
         set(CPACK_RPM_POST_INSTALL_SCRIPT_FILE
             ${CMAKE_CURRENT_BINARY_DIR}/package_postupgrade.sh)
+        list(APPEND CPACK_DEBIAN_PACKAGE_CONTROL_EXTRA
+            ${CMAKE_CURRENT_BINARY_DIR}/postinst)
     endif ()
 endmacro(SetPackageInstallScripts)
 
diff --git a/cmake/package_postupgrade.sh.in b/cmake/package_postupgrade.sh.in
index 0ef78413c3..4e199d005c 100755
--- a/cmake/package_postupgrade.sh.in
+++ b/cmake/package_postupgrade.sh.in
@@ -48,21 +48,13 @@ if [ -n "${sampleFiles}" ]; then
 EOF
 fi
 
-# make sure that world-writeable dirs have the sticky bit set
-# so that unprivileged can't rename/remove files within
-
-if [ -d /var/opt/bro/spool ]; then
-    chmod +t /var/opt/bro/spool
-fi
-
-if [ -d /var/opt/bro/spool/tmp ]; then
-    chmod +t /var/opt/bro/spool/tmp
-fi
-
-if [ -d /var/opt/bro/spool/policy ]; then
-    chmod +t /var/opt/bro/spool/policy
-fi
-
-if [ -d /var/opt/bro/logs ]; then
-    chmod +t /var/opt/bro/logs
+# Set up world writeable spool and logs directory for broctl, making sure
+# to set the sticky bit so that unprivileged users can't rename/remove files.
+# (CMake/CPack is supposed to install them, but has problems with empty dirs)
+if [ -n "@EMPTY_WORLD_DIRS@" ]; then
+    for dir in "@EMPTY_WORLD_DIRS@"; do
+        mkdir -p ${dir}
+        chmod 777 ${dir}
+        chmod +t ${dir}
+    done
 fi
diff --git a/doc/CMakeLists.txt b/doc/CMakeLists.txt
index 00e0974919..e2c3f25f4e 100644
--- a/doc/CMakeLists.txt
+++ b/doc/CMakeLists.txt
@@ -1,42 +1 @@
-set(POLICY_SRC_DIR ${PROJECT_SOURCE_DIR}/policy)
-set(DOC_OUTPUT_DIR ${CMAKE_CURRENT_BINARY_DIR}/out)
-set(DOC_SOURCE_DIR ${CMAKE_CURRENT_SOURCE_DIR}/source)
-set(DOC_SOURCE_WORKDIR ${CMAKE_CURRENT_BINARY_DIR}/source)
-
-file(GLOB_RECURSE DOC_SOURCES FOLLOW_SYMLINKS "*")
-
-configure_file(${CMAKE_CURRENT_SOURCE_DIR}/conf.py.in
-               ${CMAKE_CURRENT_BINARY_DIR}/conf.py
-               @ONLY)
-configure_file(${CMAKE_CURRENT_SOURCE_DIR}/scripts/generate_reST_docs.py.in
-               ${CMAKE_CURRENT_BINARY_DIR}/generate_reST_docs.py
-               @ONLY)
-configure_file(${CMAKE_CURRENT_SOURCE_DIR}/scripts/BroToReST.py.in
-               ${CMAKE_CURRENT_BINARY_DIR}/BroToReST.py
-               @ONLY)
-
-add_custom_target(doc
-                  COMMAND "${CMAKE_COMMAND}" -E copy_directory
-                          ${DOC_SOURCE_DIR}
-                          ${DOC_SOURCE_WORKDIR}
-                  COMMAND python generate_reST_docs.py
-                  COMMAND sphinx-build
-                          -b html
-                          -c ${CMAKE_CURRENT_BINARY_DIR}
-                          -d ${DOC_OUTPUT_DIR}/doctrees
-                          ${DOC_SOURCE_WORKDIR}
-                          ${DOC_OUTPUT_DIR}/html
-                  WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
-                  COMMENT "[Sphinx] Generating Script Documentation"
-                  VERBATIM
-                  # SOURCES just adds stuff to IDE projects as a convienience
-                  SOURCES ${DOC_SOURCES})
-
-add_dependencies(doc bro doc-clean)
-
-add_custom_target(doc-clean
-                  COMMAND "${CMAKE_COMMAND}" -E remove_directory
-                          ${CMAKE_CURRENT_BINARY_DIR}/source
-                  COMMAND "${CMAKE_COMMAND}" -E remove_directory
-                          ${DOC_OUTPUT_DIR}
-                  VERBATIM)
+add_subdirectory(scripts)
diff --git a/doc/README b/doc/README
index 150260ed09..1333ed77b7 100644
--- a/doc/README
+++ b/doc/README
@@ -1,44 +1 @@
-This directory contains scripts and templates that can be used to automate
-the generation of Bro script documentation.  Two build targets are defined
-by CMake:
-
-``make doc``
-
-    This target depends on a Python interpreter (>=2.5) and
-    `Sphinx <http://sphinx.pocoo.org/>`_ being installed.  Sphinx can be
-    installed like::
-
-        > sudo easy_install sphinx
-
-    This target will also first build the bro binary if it is not already
-    since the generation of reStructuredText (reST) documentation from
-    Bro scripts is integrated within the parsing process.
-
-    After completion, HTML documentation can be located inside the CMake
-    ``build/`` directory as ``build/doc/out/html``.  The generated reST
-    documentation will be located in ``build/doc/source/policy``.
-
-``make doc-clean``
-
-    This target removes Sphinx inputs and outputs from the CMake ``build/`` dir.
-
-To schedule a script to be documented, edit ``scripts/generate_reST_docs.py.in``
-and try adding the name of the script along with an optional script group to
-the ``docs`` dictionary.  That python script also shows other, more specialized
-methods for generating documentation for some types of corner-cases.
-
-When adding a new logical grouping for generated scripts, create a new
-reST document in ``source/policy/<group_name>.rst`` and add some default
-documentation.  References to (and summaries of) documents associated with
-the group get appended to this file during the ``make doc`` process.
-
-The Sphinx source tree template in ``source/`` can be modified to add more
-common/general documentation, style sheets, JavaScript, etc.  The Sphinx
-config file is produced from ``conf.py.in``, so that can be edited to change
-various Sphinx options, like setting the default HTML rendering theme.
-There is also a custom Sphinx domain implemented in ``source/ext/bro.py``
-which adds some reST directives and roles that aid in generating useful
-index entries and cross-references.
-
-See ``example.bro`` for an example of how to document a Bro script such that
-``make doc`` will be able to produce reST/HTML documentation for it.
+TODO
diff --git a/doc/scripts/BroToReST.py.in b/doc/scripts/BroToReST.py.in
deleted file mode 100755
index 89a8e1cc57..0000000000
--- a/doc/scripts/BroToReST.py.in
+++ /dev/null
@@ -1,152 +0,0 @@
-#! /usr/bin/env python
-
-import os
-import subprocess
-import shutil
-import glob
-import string
-import sys
-
-BRO = "@CMAKE_BINARY_DIR@/src/bro"
-BROPATHDEV = "`@CMAKE_BINARY_DIR@/bro-path-dev`"
-BRO_ARGS = "--doc-scripts"
-DOC_DST_DIR = "@DOC_SOURCE_WORKDIR@/policy"
-BROPATH = subprocess.Popen("@CMAKE_BINARY_DIR@/bro-path-dev", shell=True,
-        stdout=subprocess.PIPE, stderr=subprocess.STDOUT).stdout.readline()
-
-class BroToReST:
-    """A class to encapsulate the the generation of reST documentation from
-    a given Bro script.
-    """
-
-    bro_src_file = None
-    doc_src_file = None
-    load_via_stdin = False
-    group = None
-
-    def __init__(self, src_file, load_method=False, search_dir=None, group=None):
-        """
-        :param src_file: the file name of a Bro script (not a path)
-        :param load_method: T if script must be loaded by Bro via a stdin
-            redirection of "@load <script>", F if script can be loaded as
-            a command line argument to Bro
-        :param search_dir: a list of directories in which to search for
-            src_file.  If None, the default BROPATH is used.
-        :param group: a string representing a logical group that the script's
-            documentation should belong to.  A corresponding <group>.rst
-            document must be pre-existing in the policy/ dir of the source tree
-            used by Sphinx.
-        """
-
-        self.bro_src_file = FindBroScript(src_file, search_dir)
-        self.load_via_stdin = load_method
-        self.group = group
-
-        # formulate doc_src_file from src_file
-        filename = os.path.basename(src_file)
-        basename, ext = os.path.splitext(filename)
-        if ext == ".bro":
-            self.doc_src_file = basename + ".rst"
-        else:
-            self.doc_src_file = filename + ".rst"
-
-    def __str__(self):
-        return "bro_src_file: " + self.bro_src_file \
-           + "\ndoc_src_file: " + self.doc_src_file \
-           + "\ndoc_dst_file: " + os.path.join(DOC_DST_DIR, self.doc_src_file) \
-           + "\nstdin_load: %s" % self.load_via_stdin \
-           + "\ngroup: %s" % self.group
-
-    def GenDoc(self):
-        """Generates the reST documentation for a Bro script and copies
-        both the documentation and original script into Sphinx source tree.
-        If the documentation belongs to a group, the necessary modifications
-        to add it to the group's documentation are done.  Afterwards, any
-        files with a ".rst" suffix are removed for the working directory.
-        """
-
-        bro_src_basename = os.path.basename(self.bro_src_file)
-
-        if self.load_via_stdin:
-            cmd = "echo '@load %s' | %s %s" % (bro_src_basename, BRO, BRO_ARGS)
-        else:
-            cmd = "%s %s %s" % (BRO, BRO_ARGS, self.bro_src_file)
-
-        p = subprocess.Popen(cmd, shell=True, env={"BROPATH": BROPATH})
-
-        if p.wait() == 0:
-            shutil.copy(self.doc_src_file, DOC_DST_DIR)
-            shutil.copy(self.bro_src_file, DOC_DST_DIR)
-            AppendToDocGroup(self.group, self.bro_src_file, self.doc_src_file)
-
-        for leftover in glob.glob("*.rst"):
-            os.remove(leftover)
-
-def GenDocs(doc_dict, load_method=False):
-    """Generates reST documentation for all scripts in the given dictionary.
-
-    :param doc_dict: a dictionary whose keys are file names of Bro scripts
-        (not paths), and whose value is the logical documentation group
-        it belongs to
-    :param load_method: T if script must be loaded by Bro via a stdin
-            redirection of "@load <script>", F if script can be loaded as
-            a command line argument to Bro
-    """
-
-    for k, v in doc_dict.iteritems():
-        doc = BroToReST(k, load_method, group=v)
-        print "Generating reST document for " + k
-        doc.GenDoc()
-
-def FindBroScript(src_file, search_dir=None):
-    """Search a set of paths for a given Bro script and return the absolute
-    path to it.
-
-    :param src_file: the file name of a Bro script (not a path)
-    :param search_dir: a list of directories in which to search for
-        src_file.  If None, the default BROPATH is used.
-    """
-    if search_dir is None:
-        search_dir = string.split(BROPATH, ":")
-    for path in search_dir:
-        abs_path = os.path.join(path, src_file)
-        if os.path.exists(abs_path):
-            return abs_path
-    print >> sys.stderr, "Couldn't find '%s'" % src_file
-    return None
-
-def AppendToDocGroup(group, src_file, doc_file):
-    """Adds a reference to the given documentation for a Bro script
-    to the documentation file for it's associated group.  Also, associated
-    summary text (comments marked up like "##!" in the original Bro script
-    source) are added.
-
-    :param group: a string representing a logical group that the script's
-        documentation should belong to.  A corresponding <group>.rst
-        document must be pre-existing in the policy/ dir of the source tree
-        used by Sphinx.
-    :param src_file: a path to the original Bro script source file
-    :param doc_file: the file name of a script's generated reST document
-    """
-    if group is None:
-        return
-
-    group_file = os.path.join(DOC_DST_DIR, group + ".rst")
-    if not os.path.exists(group_file):
-        print >> sys.stderr, "Group file doesn't exist: " + group_file
-        return
-
-    summary_comments = []
-
-    with open(src_file, 'r') as f:
-        for line in f:
-            sum_pos = string.find(line, "##!")
-            if sum_pos != -1:
-                summary_comments.append(line[(sum_pos+3):])
-
-    doc_name, ext = os.path.splitext(doc_file)
-
-    with open(group_file, 'a') as f:
-        f.write("\n:doc:`%s`\n" % doc_name)
-        for line in summary_comments:
-            f.write(line)
diff --git a/doc/scripts/CMakeLists.txt b/doc/scripts/CMakeLists.txt
new file mode 100644
index 0000000000..582676a9b3
--- /dev/null
+++ b/doc/scripts/CMakeLists.txt
@@ -0,0 +1,264 @@
+set(POLICY_SRC_DIR ${PROJECT_SOURCE_DIR}/policy)
+set(BIF_SRC_DIR ${PROJECT_SOURCE_DIR}/src)
+set(RST_OUTPUT_DIR ${CMAKE_CURRENT_BINARY_DIR}/rest_output)
+set(DOC_OUTPUT_DIR ${CMAKE_CURRENT_BINARY_DIR}/out)
+set(DOC_SOURCE_DIR ${CMAKE_CURRENT_SOURCE_DIR}/source)
+set(DOC_SOURCE_WORKDIR ${CMAKE_CURRENT_BINARY_DIR}/source)
+
+file(GLOB_RECURSE DOC_SOURCES FOLLOW_SYMLINKS "*")
+
+# configure the Sphinx config file (expand variables CMake might know about)
+configure_file(${CMAKE_CURRENT_SOURCE_DIR}/conf.py.in
+               ${CMAKE_CURRENT_BINARY_DIR}/conf.py
+               @ONLY)
+
+# find out what BROPATH to use when executing bro
+execute_process(COMMAND ${CMAKE_BINARY_DIR}/bro-path-dev
+                OUTPUT_VARIABLE BROPATH
+                RESULT_VARIABLE retval
+                OUTPUT_STRIP_TRAILING_WHITESPACE)
+if (NOT ${retval} EQUAL 0)
+    message(FATAL_ERROR "Problem setting BROPATH")
+endif ()
+
+# This macro is used to add a new makefile target for reST policy script
+# documentation that can be generated using Bro itself to parse policy scripts.
+# It's called like:
+#
+#     rest_target(srcDir broInput [group])
+#
+# srcDir: the directory which contains broInput
+# broInput: the file name of a bro policy script
+# group: optional name of group that the script documentation will belong to
+#
+# In addition to adding the makefile target, several CMake variables are set:
+#
+# MASTER_POLICY_INDEX_TEXT: a running list of policy scripts docs that have
+#   been generated so far, formatted such that it can be appended to a file
+#   that ends in a Sphinx toctree directive
+# ALL_REST_OUTPUTS: a running list (the CMake list type) of all reST docs
+#   that are to be generated
+# MASTER_GROUP_LIST: a running list (the CMake list type) of all script groups
+# ${group}_files: a running list of files belonging to a given group, from
+#   which summary text can be extracted at build time
+# ${group}_doc_names: a running list of reST style document names that can be
+#   given to a :doc: role, shared indices with ${group}_files
+#
+macro(REST_TARGET srcDir broInput)
+    get_filename_component(basename ${broInput} NAME_WE)
+    get_filename_component(extension ${broInput} EXT)
+    get_filename_component(relDstDir ${broInput} PATH)
+
+    set(sumTextSrc ${srcDir}/${broInput})
+    if (${extension} STREQUAL ".bif.bro")
+        set(basename "${basename}.bif")
+        # the summary text is taken at configure time, but .bif.bro files
+        # may not have been generated yet, so read .bif file instead
+        set(sumTextSrc ${BIF_SRC_DIR}/${basename})
+    elseif (${extension} STREQUAL ".init")
+        set(basename "${basename}.init")
+    endif ()
+
+    set (restFile "${basename}.rst")
+
+    if (NOT relDstDir)
+        set(docName "${basename}")
+        set(dstDir "${RST_OUTPUT_DIR}")
+    else ()
+        set(docName "${relDstDir}/${basename}")
+        set(dstDir "${RST_OUTPUT_DIR}/${relDstDir}")
+    endif ()
+
+    set(restOutput "${dstDir}/${restFile}")
+
+    set(indexEntry "   ${docName} <${docName}>")
+    set(MASTER_POLICY_INDEX_TEXT "${MASTER_POLICY_INDEX_TEXT}\n${indexEntry}")
+    list(APPEND ALL_REST_OUTPUTS ${restOutput})
+
+    if (NOT "${ARGN}" STREQUAL "")
+        set(group ${ARGN})
+        # add group to master group list if not already in it
+        list(FIND MASTER_GROUP_LIST ${group} _found)
+        if (_found EQUAL -1)
+            list(APPEND MASTER_GROUP_LIST ${group})
+            if (MASTER_GROUP_LIST_TEXT)
+               set(MASTER_GROUP_LIST_TEXT "${MASTER_GROUP_LIST_TEXT}\n${group}")
+            else ()
+               set(MASTER_GROUP_LIST_TEXT "${group}")
+            endif ()
+        endif ()
+
+        list(APPEND ${group}_files ${sumTextSrc})
+        list(APPEND ${group}_doc_names ${docName})
+    else ()
+        set(group "")
+    endif ()
+
+    if (${group} STREQUAL "default" OR ${group} STREQUAL "bifs")
+        set(BRO_ARGS --doc-scripts --exec '')
+    else ()
+        set(BRO_ARGS --doc-scripts ${srcDir}/${broInput})
+    endif ()
+
+    add_custom_command(OUTPUT ${restOutput}
+        # delete any leftover state from previous bro runs
+        COMMAND "${CMAKE_COMMAND}"
+        ARGS -E remove_directory .state
+        # generate the reST documentation using bro
+        COMMAND BROPATH=${BROPATH} ${CMAKE_BINARY_DIR}/src/bro
+        ARGS ${BRO_ARGS} || (rm -rf .state *.log *.rst && exit 1)
+        # move generated doc into a new directory tree that
+        # defines the final structure of documents
+        COMMAND "${CMAKE_COMMAND}"
+        ARGS -E make_directory ${dstDir}
+        COMMAND "${CMAKE_COMMAND}"
+        ARGS -E copy ${restFile} ${restOutput}
+        # copy the bro policy script, too
+        COMMAND "${CMAKE_COMMAND}"
+        ARGS -E copy ${srcDir}/${broInput} ${dstDir}
+        # clean up the build directory
+        COMMAND rm
+        ARGS -rf .state *.log *.rst
+        DEPENDS bro
+        DEPENDS ${srcDir}/${broInput}
+        COMMENT "[Bro] Generating reST docs for ${broInput}"
+    )
+
+endmacro(REST_TARGET)
+
+# Schedule Bro scripts for which to generate documentation.
+# Note: the script may be located in a subdirectory off of one of the main
+# directories in BROPATH.  In that case, just list the script as 'foo/bar.bro'
+rest_target(${POLICY_SRC_DIR} alarm.bro                         user)
+rest_target(${POLICY_SRC_DIR} arp.bro                           user)
+rest_target(${POLICY_SRC_DIR} conn.bro                          user)
+rest_target(${POLICY_SRC_DIR} dhcp.bro                          user)
+rest_target(${POLICY_SRC_DIR} dns.bro                           user)
+rest_target(${POLICY_SRC_DIR} ftp.bro                           user)
+rest_target(${POLICY_SRC_DIR} http.bro                          user)
+rest_target(${POLICY_SRC_DIR} http-reply.bro                    user)
+rest_target(${POLICY_SRC_DIR} http-request.bro                  user)
+rest_target(${POLICY_SRC_DIR} irc.bro                           user)
+rest_target(${POLICY_SRC_DIR} smtp.bro                          user)
+rest_target(${POLICY_SRC_DIR} ssl.bro                           user)
+rest_target(${POLICY_SRC_DIR} ssl-ciphers.bro                   user)
+rest_target(${POLICY_SRC_DIR} ssl-errors.bro                    user)
+rest_target(${POLICY_SRC_DIR} synflood.bro                      user)
+rest_target(${POLICY_SRC_DIR} tcp.bro                           user)
+rest_target(${POLICY_SRC_DIR} udp.bro                           user)
+rest_target(${POLICY_SRC_DIR} weird.bro                         user)
+rest_target(${CMAKE_CURRENT_SOURCE_DIR} example.bro             internal)
+
+# Finding out what scripts bro will generate documentation for by default
+# can be done like: `bro --doc-scripts --exec ""`
+rest_target(${POLICY_SRC_DIR} bro.init                          default)
+rest_target(${POLICY_SRC_DIR} logging-ascii.bro                 default)
+rest_target(${POLICY_SRC_DIR} logging.bro                       default)
+rest_target(${POLICY_SRC_DIR} pcap.bro                          default)
+rest_target(${POLICY_SRC_DIR} server-ports.bro                  default)
+rest_target(${CMAKE_BINARY_DIR}/src bro.bif.bro                 bifs)
+rest_target(${CMAKE_BINARY_DIR}/src const.bif.bro               bifs)
+rest_target(${CMAKE_BINARY_DIR}/src event.bif.bro               bifs)
+rest_target(${CMAKE_BINARY_DIR}/src logging.bif.bro             bifs)
+rest_target(${CMAKE_BINARY_DIR}/src strings.bif.bro             bifs)
+rest_target(${CMAKE_BINARY_DIR}/src types.bif.bro               bifs)
+
+# create temporary list of all docs to include in the master policy/index file
+file(WRITE ${CMAKE_CURRENT_BINARY_DIR}/tmp_policy_index
+    "${MASTER_POLICY_INDEX_TEXT}")
+
+# create temporary file containing list of all groups
+file(WRITE ${CMAKE_CURRENT_BINARY_DIR}/group_list
+    "${MASTER_GROUP_LIST_TEXT}")
+
+# create temporary files containing list of each source file in a given group
+foreach (group ${MASTER_GROUP_LIST})
+    if (EXISTS ${CMAKE_CURRENT_BINARY_DIR}/${group}_files)
+        file(REMOVE ${CMAKE_CURRENT_BINARY_DIR}/${group}_files)
+    endif ()
+    if (EXISTS ${CMAKE_CURRENT_BINARY_DIR}/${group}_doc_names)
+        file(REMOVE ${CMAKE_CURRENT_BINARY_DIR}/${group}_doc_names)
+    endif ()
+    foreach (src ${${group}_files})
+        file(APPEND ${CMAKE_CURRENT_BINARY_DIR}/${group}_files "${src}\n")
+    endforeach ()
+    foreach (dname ${${group}_doc_names})
+        file(APPEND ${CMAKE_CURRENT_BINARY_DIR}/${group}_doc_names "${dname}\n")
+    endforeach ()
+endforeach ()
+
+# remove previously generated docs no longer scheduled for generation
+if (EXISTS ${RST_OUTPUT_DIR})
+    file(GLOB_RECURSE EXISTING_REST_DOCS "${RST_OUTPUT_DIR}/*.rst")
+    foreach (_doc ${EXISTING_REST_DOCS})
+        list(FIND ALL_REST_OUTPUTS ${_doc} _found)
+        if (_found EQUAL -1)
+            file(REMOVE ${_doc})
+            message(STATUS "Removing stale reST doc: ${_doc}")
+        endif ()
+    endforeach ()
+endif ()
+
+# The "restdoc" target uses Bro to parse policy scripts in order to
+# generate reST documentation from them.
+add_custom_target(restdoc
+                  # create symlink to the reST output directory for convenience
+                  COMMAND "${CMAKE_COMMAND}" -E create_symlink
+                          ${RST_OUTPUT_DIR}
+                          ${CMAKE_BINARY_DIR}/reST
+                  DEPENDS ${ALL_REST_OUTPUTS})
+
+# The "restclean" target removes all generated reST documentation from the
+# build directory.
+add_custom_target(restclean
+                  COMMAND "${CMAKE_COMMAND}" -E remove_directory
+                          ${RST_OUTPUT_DIR}
+                  VERBATIM)
+
+# The "doc" target generates reST documentation for any outdated bro scripts
+# and then uses Sphinx to generate HTML documentation from the reST
+add_custom_target(doc
+                  # copy the template documentation to the build directory
+                  # to give as input for sphinx
+                  COMMAND "${CMAKE_COMMAND}" -E copy_directory
+                          ${DOC_SOURCE_DIR}
+                          ${DOC_SOURCE_WORKDIR}
+                  # copy generated policy script documentation into the
+                  # working copy of the template documentation
+                  COMMAND "${CMAKE_COMMAND}" -E copy_directory
+                          ${RST_OUTPUT_DIR}
+                          ${DOC_SOURCE_WORKDIR}/policy
+                  # append to the master index of all policy scripts
+                  COMMAND cat ${CMAKE_CURRENT_BINARY_DIR}/tmp_policy_index >>
+                          ${DOC_SOURCE_WORKDIR}/policy/index.rst
+                  # construct a reST file for each group
+                  COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/group_index_generator.py
+                          ${CMAKE_CURRENT_BINARY_DIR}/group_list
+                          ${CMAKE_CURRENT_BINARY_DIR}
+                          ${DOC_SOURCE_WORKDIR}
+                  # tell sphinx to generate html
+                  COMMAND sphinx-build
+                          -b html
+                          -c ${CMAKE_CURRENT_BINARY_DIR}
+                          -d ${DOC_OUTPUT_DIR}/doctrees
+                          ${DOC_SOURCE_WORKDIR}
+                          ${DOC_OUTPUT_DIR}/html
+                  # create symlink to the html output directory for convenience
+                  COMMAND "${CMAKE_COMMAND}" -E create_symlink
+                          ${DOC_OUTPUT_DIR}/html
+                          ${CMAKE_BINARY_DIR}/html
+                  WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
+                  COMMENT "[Sphinx] Generating HTML policy script docs"
+                  # SOURCES just adds stuff to IDE projects as a convienience
+                  SOURCES ${DOC_SOURCES})
+
+# The "docclean" target removes just the Sphinx input/output directories
+# from the build directory.
+add_custom_target(docclean
+                  COMMAND "${CMAKE_COMMAND}" -E remove_directory
+                          ${DOC_SOURCE_WORKDIR}
+                  COMMAND "${CMAKE_COMMAND}" -E remove_directory
+                          ${DOC_OUTPUT_DIR}
+                  VERBATIM)
+
+add_dependencies(doc docclean restdoc)
diff --git a/doc/scripts/README b/doc/scripts/README
new file mode 100644
index 0000000000..85496322d9
--- /dev/null
+++ b/doc/scripts/README
@@ -0,0 +1,61 @@
+This directory contains scripts and templates that can be used to automate
+the generation of Bro script documentation.  Several build targets are defined
+by CMake:
+
+``restdoc``
+
+    This target uses Bro to parse policy scripts in order to generate
+    reStructuredText (reST) documentation from them.  The list of scripts
+    for which to generate reST documentation is defined in the
+    ``CMakeLists.txt`` file in this directory.  Script documentation is
+    rebuild automatically if the policy script from which it is derived
+    or the Bro binary becomes out of date
+
+    The resulting output from this target can be found in the CMake
+    ``build/`` directory inside ``reST`` (a symlink to
+    ``doc/scripts/rest_output``).
+
+``doc``
+
+    This target depends on a Python interpreter (>=2.5) and
+    `Sphinx <http://sphinx.pocoo.org/>`_ being installed.  Sphinx can be
+    installed like::
+
+        > sudo easy_install sphinx
+
+    This target will first build ``restdoc`` target and then copy the
+    resulting reST files as an input directory to Sphinx.
+
+    After completion, HTML documentation can be located in the CMake
+    ``build/`` directory inside ``html`` (a symlink to
+    ``doc/scripts/out/html``)
+
+``restclean``
+
+    This target removes any reST documentation that has been generated so far.
+
+``docclean``
+
+    This target removes Sphinx inputs and outputs from the CMake ``build/`` dir.
+
+To schedule a script to be documented, edit ``CMakeLists.txt`` inside this
+directory add a call to the ``rest_target()`` macro.  Calling that macro
+with a group name for the script is optional, but if not given, the only
+link to the script will be in the master TOC tree for all policy scripts.
+
+When adding a new logical grouping for generated scripts, create a new
+reST document in ``source/<group_name>.rst`` and add some default
+documentation for the group.  References to (and summaries of) documents
+associated with the group get appended to this file during the
+``make doc`` process.
+
+The Sphinx source tree template in ``source/`` can be modified to add more
+common/general documentation, style sheets, JavaScript, etc.  The Sphinx
+config file is produced from ``conf.py.in``, so that can be edited to change
+various Sphinx options, like setting the default HTML rendering theme.
+There is also a custom Sphinx domain implemented in ``source/ext/bro.py``
+which adds some reST directives and roles that aid in generating useful
+index entries and cross-references.
+
+See ``example.bro`` for an example of how to document a Bro script such that
+``make doc`` will be able to produce reST/HTML documentation for it.
diff --git a/doc/conf.py.in b/doc/scripts/conf.py.in
similarity index 100%
rename from doc/conf.py.in
rename to doc/scripts/conf.py.in
diff --git a/doc/example.bro b/doc/scripts/example.bro
similarity index 77%
rename from doc/example.bro
rename to doc/scripts/example.bro
index f148788ce4..2e2a8977ec 100644
--- a/doc/example.bro
+++ b/doc/scripts/example.bro
@@ -6,6 +6,18 @@
 ##!
 ##! .. tip:: You can embed directives and roles within ``##``-stylized comments.
 ##!
+##! A script's logging information has to be documented manually as minimally
+##! shown below.  Note that references may not always be possible (e.g.
+##! anonymous filter functions) and a script may not need to document
+##! each of "columns", "event", "filter" depending on exactly what it's doing.
+##!
+##! **Logging Stream ID:** :bro:enum:`Example::EXAMPLE`
+##!     :Columns:    :bro:type:`Example::Info`
+##!     :Event:      :bro:id:`Example::log_example`
+##!     :Filter:     ``example-filter``
+##!         uses :bro:id:`Example::filter_func` to determine whether to
+##!         exclude the ``ts`` field
+##!
 ##! :Author: Jon Siwek <jsiwek@ncsa.illinois.edu>
 
 # Comments that use a single pound sign (#) are not significant to
@@ -64,6 +76,12 @@ redef enum Notice += {
     Notice_Four,
 };
 
+# Redef'ing the ID enumeration for logging streams is automatically tracked.
+# Comments of the "##" form can be use to further document it, but it's
+# better to do all documentation related to logging in the summary section
+# as is shown above.
+redef enum Log::ID += { EXAMPLE };
+
 # Anything declared in the export section will show up in the rendered
 # documentation's "public interface" section
 
@@ -107,6 +125,11 @@ export {
         field2: bool; ##< toggles something
     };
 
+    ## document the record extension redef here
+    redef record SimpleRecord += {
+        ## document the extending field here
+        field_ext: string &optional; ##< (or here)
+    };
 
     ## general documentation for a type "ComplexRecord" goes here
     type ComplexRecord: record {
@@ -116,6 +139,13 @@ export {
         msg: string &default="blah"; ##< attributes are self-documenting
     } &redef;
 
+    ## An example record to be used with a logging stream.
+    type Info: record {
+        ts:       time       &log;
+        uid:      string     &log;
+        status:   count      &log &optional;
+    };
+
     ############## options ################
     # right now, I'm just defining an option as
     # any const with &redef (something that can
@@ -159,8 +189,17 @@ export {
     ## Give more details about "an_event" here.
     ## name: describe the argument here
     global an_event: event(name: string);
+
+    ## This is a declaration of an example event that can be used in
+    ## logging streams and is raised once for each log entry.
+    global log_example: event(rec: Info);
 }
 
+function filter_func(rec: Info): bool
+    {
+    return T;
+    }
+
 # this function is documented in the "private interface" section
 # of generated documentation and any "##"-stylized comments would also
 # be rendered there
@@ -176,3 +215,14 @@ type PrivateRecord: record {
     field1: bool;
     field2: count;
 };
+
+event bro_init()
+    {
+    Log::create_stream(EXAMPLE, [$columns=Info, $ev=log_example]);
+    Log::add_filter(EXAMPLE, [
+        $name="example-filter",
+        $path="example-filter",
+        $pred=filter_func,
+        $exclude=set("ts")
+        ]);
+    }
diff --git a/doc/scripts/generate_reST_docs.py.in b/doc/scripts/generate_reST_docs.py.in
deleted file mode 100755
index 3278c42367..0000000000
--- a/doc/scripts/generate_reST_docs.py.in
+++ /dev/null
@@ -1,71 +0,0 @@
-#! /usr/bin/env python
-
-import os
-import subprocess
-import shutil
-import glob
-import string
-import sys
-from BroToReST import *
-
-# TODO: generate docs for more scripts
-# TODO: the groups are just made up to test the functionality, fix them
-
-# Scripts that can be loaded by bro via command line argument:
-docs = {
-    "alarm.bro":        "internal",
-    "arp.bro":          "user",
-    "conn.bro":         "internal",
-    "dhcp.bro":         "user",
-    "dns.bro":          "user",
-    "ftp.bro":          "user",
-    "http.bro":         "user",
-    "http-reply.bro":   None,
-    "http-request.bro": None,
-    "irc.bro":          "user",
-    "smtp.bro":         "user",
-    "ssl.bro":          "user",
-    "ssl-ciphers.bro":  None,
-    "ssl-errors.bro":   None,
-    "synflood.bro":     "user",
-    "tcp.bro":          "user",
-    "udp.bro":          "user",
-    "weird.bro":        "internal",
-}
-
-# Scripts that can't be loaded by bro via command line argument (possible
-# due to dependency issues), but can be loaded via an @load on stdin:
-stdin_docs = {
-    "notice.bro": "internal",
-}
-
-GenDocs(docs)
-GenDocs(stdin_docs, True)
-
-# The example documentation script doesn't live on the BROPATH, so
-# explicitly generate the docs for it like this:
-BroToReST("example.bro", False, ["@PROJECT_SOURCE_DIR@/doc"], group="internal").GenDoc()
-
-# Generate documentation for stuff that's always loaded into bro by default:
-cmd = "echo '' | %s %s" % (BRO, BRO_ARGS)
-p = subprocess.Popen(cmd, shell=True, env={"BROPATH": BROPATH})
-if p.wait() == 0:
-    for doc in glob.glob("*.rst"):
-        if doc == "<stdin>.rst":
-            os.remove(doc)
-            continue
-
-        basename, ext = os.path.splitext(doc)
-        basename2, ext = os.path.splitext(basename)
-        if ext == ".init":
-            src_file = basename
-        else:
-            src_file = basename + ".bro"
-        src_file = FindBroScript(src_file)
-        shutil.copy(src_file, DOC_DST_DIR)
-        shutil.copy(doc, DOC_DST_DIR)
-        if ext == ".bif":
-            AppendToDocGroup("bifs", src_file, doc)
-        else:
-            AppendToDocGroup("default", src_file, doc)
-        os.remove(doc)
diff --git a/doc/scripts/group_index_generator.py b/doc/scripts/group_index_generator.py
new file mode 100755
index 0000000000..d143765ef9
--- /dev/null
+++ b/doc/scripts/group_index_generator.py
@@ -0,0 +1,52 @@
+#! /usr/bin/env python
+
+# This script automatically generates a reST documents that lists
+# a collection of Bro policy scripts that are "grouped" together.
+# The summary text (##! comments) of the policy script is embedded
+# in the list.
+#
+# 1st argument is the file containing list of groups
+# 2nd argument is the directory containing ${group}_files lists of
+#   scripts that belong to the group and ${group}_doc_names lists of
+#   document names that can be supplied to a reST :doc: role
+# 3rd argument is a directory in which write a ${group}.rst file (will
+#   append to existing file) that contains reST style references to
+#   script docs along with summary text contained in original script
+
+import sys
+import os
+import string
+
+group_list = sys.argv[1]
+file_manifest_dir = sys.argv[2]
+output_dir = sys.argv[3]
+
+with open(group_list, 'r') as f_group_list:
+    for group in f_group_list.read().splitlines():
+        #print group
+        file_manifest = os.path.join(file_manifest_dir, group + "_files")
+        doc_manifest = os.path.join(file_manifest_dir, group + "_doc_names")
+        src_files = []
+        doc_names = []
+
+        with open(file_manifest, 'r') as f_file_manifest:
+            src_files = f_file_manifest.read().splitlines()
+
+        with open(doc_manifest, 'r') as f_doc_manifest:
+            doc_names = f_doc_manifest.read().splitlines()
+
+        for i in range(len(src_files)):
+            src_file = src_files[i]
+            #print "\t" + src_file
+            summary_comments = []
+            with open(src_file, 'r') as f_src_file:
+                for line in f_src_file:
+                    sum_pos = string.find(line, "##!")
+                    if sum_pos != -1:
+                        summary_comments.append(line[(sum_pos+3):])
+            #print summary_comments
+            group_file = os.path.join(output_dir, group + ".rst")
+            with open(group_file, 'a') as f_group_file:
+                f_group_file.write("\n:doc:`/policy/%s`\n" % doc_names[i])
+                for line in summary_comments:
+                    f_group_file.write("   " + line)
diff --git a/doc/source/_static/showhide.js b/doc/scripts/source/_static/showhide.js
similarity index 100%
rename from doc/source/_static/showhide.js
rename to doc/scripts/source/_static/showhide.js
diff --git a/doc/source/_templates/layout.html b/doc/scripts/source/_templates/layout.html
similarity index 100%
rename from doc/source/_templates/layout.html
rename to doc/scripts/source/_templates/layout.html
diff --git a/doc/source/policy/bifs.rst b/doc/scripts/source/bifs.rst
similarity index 100%
rename from doc/source/policy/bifs.rst
rename to doc/scripts/source/bifs.rst
diff --git a/doc/source/builtins.rst b/doc/scripts/source/builtins.rst
similarity index 98%
rename from doc/source/builtins.rst
rename to doc/scripts/source/builtins.rst
index 9c71da61bf..d1c551339d 100644
--- a/doc/source/builtins.rst
+++ b/doc/scripts/source/builtins.rst
@@ -118,4 +118,6 @@ The Bro scripting language supports the following built-in attributes.
 
 .. bro:attr:: &group
 
+.. bro:attr:: &log
+
 .. bro:attr:: (&tracked)
diff --git a/doc/source/common.rst b/doc/scripts/source/common.rst
similarity index 100%
rename from doc/source/common.rst
rename to doc/scripts/source/common.rst
diff --git a/doc/source/policy/default.rst b/doc/scripts/source/default.rst
similarity index 100%
rename from doc/source/policy/default.rst
rename to doc/scripts/source/default.rst
diff --git a/doc/source/ext/bro.py b/doc/scripts/source/ext/bro.py
similarity index 100%
rename from doc/source/ext/bro.py
rename to doc/scripts/source/ext/bro.py
diff --git a/doc/source/index.rst b/doc/scripts/source/index.rst
similarity index 79%
rename from doc/source/index.rst
rename to doc/scripts/source/index.rst
index 5f4b8eb6e0..ef642d70c7 100644
--- a/doc/source/index.rst
+++ b/doc/scripts/source/index.rst
@@ -11,11 +11,11 @@ Contents:
 
    common
    builtins
-   policy/default
-   policy/user
-   policy/bifs
-   policy/internal
    policy/index
+   default
+   bifs
+   user
+   internal
 
 Indices and tables
 ==================
diff --git a/doc/source/policy/internal.rst b/doc/scripts/source/internal.rst
similarity index 100%
rename from doc/source/policy/internal.rst
rename to doc/scripts/source/internal.rst
diff --git a/doc/source/policy/index.rst b/doc/scripts/source/policy/index.rst
similarity index 81%
rename from doc/source/policy/index.rst
rename to doc/scripts/source/policy/index.rst
index 2202eb8cea..6b8ed9319c 100644
--- a/doc/source/policy/index.rst
+++ b/doc/scripts/source/policy/index.rst
@@ -1,10 +1,6 @@
 Index of All Policy Script Documentation
 ========================================
 
-Contents:
-
 .. toctree::
    :maxdepth: 1
-   :glob:
 
-   *
diff --git a/doc/source/policy/user.rst b/doc/scripts/source/user.rst
similarity index 100%
rename from doc/source/policy/user.rst
rename to doc/scripts/source/user.rst
diff --git a/make-deb-packages b/make-deb-packages
new file mode 100755
index 0000000000..c8d501198b
--- /dev/null
+++ b/make-deb-packages
@@ -0,0 +1,52 @@
+#!/bin/sh
+
+# This script generates binary DEB packages.
+# They can be found in build/ after running.
+
+prefix=/opt/bro
+
+# CMake/CPack versions before 2.8.2 have bugs that can create bad packages
+CMAKE_PACK_REQ=2.8.2
+CMAKE_VER=`cmake -version`
+
+if [ "${CMAKE_VER}" \< "${CMAKE_PACK_REQ}" ]; then
+    echo "Package creation requires CMake > 2.8.2" >&2
+    exit 1
+fi
+
+# The DEB CPack generator depends on `dpkg-shlibdeps` to automatically
+# determine what dependencies to set for the packages
+type dpkg-shlibdeps > /dev/null 2>&1 || {
+    echo "\
+Creating DEB packages requires the `dpkg-shlibs` command, usually provided by
+the 'dpkg-dev' package, please install it first.
+" >&2;
+    exit 1;
+}
+
+# During the packaging process, `dpkg-shlibs` will fail if used on a library
+# that links to other internal/project libraries unless an RPATH is used or
+# we set LD_LIBRARY_PATH such that it can find the internal/project library
+# in the temporary packaging tree.
+export LD_LIBRARY_PATH=./${prefix}/lib
+
+# Minimum Bro
+./configure --prefix=${prefix} --disable-broccoli --disable-broctl \
+            --pkg-name-prefix=Bro --binary-package
+( cd build && make package )
+
+# Full Bro package
+./configure --prefix=${prefix} --pkg-name-prefix=Bro-all --binary-package
+( cd build && make package )
+
+# Broccoli
+cd aux/broccoli
+./configure --prefix=${prefix} --binary-package
+( cd build && make package && mv Broccoli*.deb ../../../build/ )
+cd ../..
+
+# Broctl
+cd aux/broctl
+./configure --prefix=${prefix} --binary-package
+( cd build && make package && mv Broctl*.deb ../../../build/ )
+cd ../..
diff --git a/policy/bro.init b/policy/bro.init
index 948874d67b..0b651d1556 100644
--- a/policy/bro.init
+++ b/policy/bro.init
@@ -69,8 +69,12 @@ type ftp_port: record {
 };
 
 type endpoint: record {
-	size: count;
+	size: count;	# logical size (for TCP: from seq numbers)
 	state: count;
+
+	# The following are set if use_conn_size_analyzer is T.
+	num_pkts: count &optional;	# number of packets on the wire
+	num_bytes_ip: count &optional;	# actual number of IP-level bytes on the wire
 };
 
 type endpoint_stats: record {
@@ -95,6 +99,7 @@ type connection: record {
 	addl: string;
 	hot: count;		# how hot; 0 = don't know or not hot
 	history: string;
+	uid: string;
 };
 
 type SYN_packet: record {
@@ -499,6 +504,12 @@ const encap_hdr_size = 0 &redef;
 # ... or just for the following UDP port.
 const tunnel_port = 0/udp &redef;
 
+# Whether to use the ConnSize analyzer to count the number of
+# packets and IP-level bytes transfered by each endpoint. If
+# true, these values are returned in the connection's endpoint
+# record val.
+const use_conn_size_analyzer = F &redef;
+
 const UDP_INACTIVE = 0;
 const UDP_ACTIVE = 1;	# means we've seen something from this endpoint
 
@@ -1176,6 +1187,10 @@ function string_escape(s: string, chars: string): string
 	return s;
 	}
 
+# The filter the user has set via the -f command line options, or
+# empty if none.
+const cmd_line_bpf_filter = "" &redef;
+
 @load pcap.bro
 
 # Rotate logs every x seconds.
diff --git a/policy/conn.bro b/policy/conn.bro
index a5d620d4c8..1c9b434ff4 100644
--- a/policy/conn.bro
+++ b/policy/conn.bro
@@ -22,6 +22,15 @@ export { global FTP::is_ftp_data_conn: function(c: connection): bool; }
 # by record_connection.
 const record_state_history = F &redef;
 
+# Whether to add 4 more columns to conn.log with 
+# orig_packet orig_ip_bytes resp_packets resp_ip_bytes
+# Requires use_conn_size_analyzer=T
+# Columns are added after history but before addl
+const report_conn_size_analyzer = F &redef;
+
+# Activate conn-size analyzer if necessary.
+redef use_conn_size_analyzer = (! report_conn_size_analyzer);
+
 # Whether to translate the local address in SensitiveConnection notices
 # to a hostname.  Meant as a demonstration of the "when" construct.
 const xlate_hot_local_addr = F &redef;
@@ -96,6 +105,12 @@ function conn_size(e: endpoint, trans: transport_proto): string
 		return "?";
 	}
 
+function conn_size_from_analyzer(e: endpoint): string
+	{
+	return fmt("%d %d", (e?$num_pkts) ? e$num_pkts : 0,
+			(e?$num_bytes_ip) ? e$num_bytes_ip : 0);
+	}
+
 function service_name(c: connection): string
 	{
 	local p = c$id$resp_p;
@@ -304,6 +319,10 @@ function record_connection(f: file, c: connection)
 		log_msg = fmt("%s %s", log_msg,
 				c$history == "" ? "X" : c$history);
 
+	if ( use_conn_size_analyzer && report_conn_size_analyzer )
+		log_msg = fmt("%s %s %s", log_msg, 
+				conn_size_from_analyzer(c$orig),  conn_size_from_analyzer(c$resp));
+
 	if ( addl != "" )
 		log_msg = fmt("%s %s", log_msg, addl);
 
diff --git a/policy/irc-bot.bro b/policy/irc-bot.bro
index 8375aa91d6..4bbe072b7d 100644
--- a/policy/irc-bot.bro
+++ b/policy/irc-bot.bro
@@ -500,7 +500,7 @@ event irc_channel_topic(c: connection, channel: string, topic: string)
 	local conn = get_conn(c);
 
 	local ch = get_channel(conn, channel);
-	ch$topic_history[|ch$topic_history| + 1] = ch$topic;
+	ch$topic_history[|ch$topic_history|] = ch$topic;
 	ch$topic = topic;
 
 	if ( c$id in bot_conns )
diff --git a/policy/pcap.bro b/policy/pcap.bro
index 091233dd52..021884a700 100644
--- a/policy/pcap.bro
+++ b/policy/pcap.bro
@@ -4,8 +4,16 @@
 global capture_filters: table[string] of string &redef;
 global restrict_filters: table[string] of string &redef;
 
-# Filter string which is unconditionally or'ed to every pcap filter.
-global unrestricted_filter = "" &redef;
+# By default, Bro will examine all packets. If this is set to false,
+# it will dynamically build a BPF filter that only select protocols
+# for which the user has loaded a corresponding analysis script.
+# The latter used to be default for Bro versions < 1.6. That has now
+# changed however to enable port-independent protocol analysis.
+const all_packets = T &redef;
+
+# Filter string which is unconditionally or'ed to every dynamically
+# built pcap filter.
+const unrestricted_filter = "" &redef;
 
 redef enum PcapFilterID += {
 	DefaultPcapFilter,
@@ -27,6 +35,7 @@ function join_filters(capture_filter: string, restrict_filter: string): string
 
 	if ( capture_filter != "" && restrict_filter != "" )
 		filter = fmt( "(%s) and (%s)", restrict_filter, capture_filter );
+
 	else if ( capture_filter != "" )
 		filter = capture_filter;
 
@@ -34,7 +43,7 @@ function join_filters(capture_filter: string, restrict_filter: string): string
 		filter = restrict_filter;
 
 	else
-		filter = "tcp or udp or icmp";
+		filter = "ip or not ip";
 
 	if ( unrestricted_filter != "" )
 		filter = fmt( "(%s) or (%s)", unrestricted_filter, filter );
@@ -44,28 +53,39 @@ function join_filters(capture_filter: string, restrict_filter: string): string
 
 function build_default_pcap_filter(): string
 	{
-	# Build capture_filter.
-	local cfilter = "";
+	if ( cmd_line_bpf_filter != "" )
+		# Return what the user specified on the command line;
+		return cmd_line_bpf_filter;
 
+	if ( all_packets )
+		{
+		# Return an "always true" filter.
+		if ( bro_has_ipv6() )
+			return "ip or not ip";
+		else
+			return "not ip6";
+		}
+
+	## Build filter dynamically.
+
+	# First the capture_filter.
+	local cfilter = "";
 	for ( id in capture_filters )
 		cfilter = add_to_pcap_filter(cfilter, capture_filters[id], "or");
 
-	# Build restrict_filter.
+	# Then the restrict_filter.
 	local rfilter = "";
-	local saw_VLAN = F;
 	for ( id in restrict_filters )
-		{
-		if ( restrict_filters[id] == "vlan" )
-			# These are special - they need to come first.
-			saw_VLAN = T;
-		else
-			rfilter = add_to_pcap_filter(rfilter, restrict_filters[id], "and");
-		}
+		rfilter = add_to_pcap_filter(rfilter, restrict_filters[id], "and");
 
-	if ( saw_VLAN )
-		rfilter = add_to_pcap_filter("vlan", rfilter, "and");
+	# Finally, join them.
+	local filter = join_filters(cfilter, rfilter);
 
-	return join_filters(cfilter, rfilter);
+	# Exclude IPv6 if we don't support it.
+	if ( ! bro_has_ipv6() )
+		filter = fmt("(not ip6) and (%s)", filter);
+
+	return filter;
 	}
 
 function install_default_pcap_filter()
diff --git a/policy/portmapper.bro b/policy/portmapper.bro
index 99ce096ee0..a67f24821b 100644
--- a/policy/portmapper.bro
+++ b/policy/portmapper.bro
@@ -295,8 +295,8 @@ function pm_mapping_to_text(server: addr, m: pm_mappings): string
 		if ( [prog, p] !in mapping_seen )
 			{
 			add mapping_seen[prog, p];
-			addls[++num_addls] = fmt("%s -> %s", rpc_prog(prog), p);
-
+			addls[num_addls] = fmt("%s -> %s", rpc_prog(prog), p);
+			++num_addls;
 			update_RPC_server_map(server, p, rpc_prog(prog));
 			}
 		}
diff --git a/policy/scan.bro b/policy/scan.bro
index c1e956125b..d3ee0574c3 100644
--- a/policy/scan.bro
+++ b/policy/scan.bro
@@ -186,17 +186,17 @@ export {
 	# More precisely, the counter is the next index of threshold vector.
 	global shut_down_thresh_reached: table[addr] of bool &default=F;
 	global rb_idx: table[addr] of count
-			&default=1 &read_expire = 1 days &redef;
+			&default=0 &read_expire = 1 days &redef;
 	global rps_idx: table[addr] of count
-			&default=1 &read_expire = 1 days &redef;
+			&default=0 &read_expire = 1 days &redef;
 	global rops_idx: table[addr] of count
-			&default=1 &read_expire = 1 days &redef;
+			&default=0 &read_expire = 1 days &redef;
 	global rpts_idx: table[addr,addr] of count
-			&default=1 &read_expire = 1 days &redef;
+			&default=0 &read_expire = 1 days &redef;
 	global rat_idx: table[addr] of count
-			&default=1 &read_expire = 1 days &redef;
+			&default=0 &read_expire = 1 days &redef;
 	global rrat_idx: table[addr] of count
-			&default=1 &read_expire = 1 days &redef;
+			&default=0 &read_expire = 1 days &redef;
 }
 
 global thresh_check: function(v: vector of count, idx: table[addr] of count,
@@ -609,7 +609,7 @@ function thresh_check(v: vector of count, idx: table[addr] of count,
 		return F;
 		}
 
-	if ( idx[orig] <= |v| && n >= v[idx[orig]] )
+	if ( idx[orig] < |v| && n >= v[idx[orig]] )
 		{
 		++idx[orig];
 		return T;
@@ -628,7 +628,7 @@ function thresh_check_2(v: vector of count, idx: table[addr, addr] of count,
 		return F;
 		}
 
-	if ( idx[orig,resp] <= |v| && n >= v[idx[orig, resp]] )
+	if ( idx[orig,resp] < |v| && n >= v[idx[orig, resp]] )
 		{
 		++idx[orig,resp];
 		return T;
diff --git a/policy/vlan.bro b/policy/vlan.bro
deleted file mode 100644
index 82fcb75af8..0000000000
--- a/policy/vlan.bro
+++ /dev/null
@@ -1,5 +0,0 @@
-# $Id: vlan.bro 416 2004-09-17 03:52:28Z vern $
-
-redef restrict_filters += { ["vlan"] = "vlan" };
-
-redef encap_hdr_size = 4;
diff --git a/src/Analyzer.cc b/src/Analyzer.cc
index 0397b0bbc9..dc9306b984 100644
--- a/src/Analyzer.cc
+++ b/src/Analyzer.cc
@@ -35,6 +35,7 @@
 #include "POP3.h"
 #include "SSH.h"
 #include "SSL-binpac.h"
+#include "ConnSizeAnalyzer.h"
 
 // Keep same order here as in AnalyzerTag definition!
 const Analyzer::Config Analyzer::analyzer_configs[] = {
@@ -56,6 +57,9 @@ const Analyzer::Config Analyzer::analyzer_configs[] = {
 	{ AnalyzerTag::ICMP_Echo, "ICMP_ECHO",
 		ICMP_Echo_Analyzer::InstantiateAnalyzer,
 		ICMP_Echo_Analyzer::Available, 0, false },
+	{ AnalyzerTag::ICMP_Redir, "ICMP_REDIR",
+		ICMP_Redir_Analyzer::InstantiateAnalyzer,
+		ICMP_Redir_Analyzer::Available, 0, false },
 
 	{ AnalyzerTag::TCP, "TCP", TCP_Analyzer::InstantiateAnalyzer,
 		TCP_Analyzer::Available, 0, false },
@@ -148,6 +152,9 @@ const Analyzer::Config Analyzer::analyzer_configs[] = {
 	{ AnalyzerTag::TCPStats, "TCPSTATS",
 		TCPStats_Analyzer::InstantiateAnalyzer,
 		TCPStats_Analyzer::Available, 0, false },
+	{ AnalyzerTag::ConnSize, "CONNSIZE", 
+		ConnSize_Analyzer::InstantiateAnalyzer,
+		ConnSize_Analyzer::Available, 0, false },
 
 	{ AnalyzerTag::Contents, "CONTENTS", 0, 0, 0, false },
 	{ AnalyzerTag::ContentLine, "CONTENTLINE", 0, 0, 0, false },
@@ -848,6 +855,12 @@ unsigned int Analyzer::MemoryAllocation() const
 	return mem;
 	}
 
+void Analyzer::UpdateConnVal(RecordVal *conn_val)
+	{
+	LOOP_OVER_CHILDREN(i)
+		(*i)->UpdateConnVal(conn_val);
+	}
+
 void SupportAnalyzer::ForwardPacket(int len, const u_char* data, bool is_orig,
 					int seq, const IP_Hdr* ip, int caplen)
 	{
diff --git a/src/Analyzer.h b/src/Analyzer.h
index d76b8a5050..c889dc6b2f 100644
--- a/src/Analyzer.h
+++ b/src/Analyzer.h
@@ -227,6 +227,13 @@ public:
 
 	virtual unsigned int MemoryAllocation() const;
 
+	// Called whenever the connection value needs to be updated. Per
+	// default, this method will be called for each analyzer in the tree.
+	// Analyzers can use this method to attach additional data to the
+	// connections. A call to BuildConnVal will in turn trigger a call to
+	// UpdateConnVal. 
+	virtual void UpdateConnVal(RecordVal *conn_val);
+
 	// The following methods are proxies: calls are directly forwarded
 	// to the connection instance.  These are for convenience only,
 	// allowing us to reuse more of the old analyzer code unchanged.
@@ -366,7 +373,6 @@ public:
 		: Analyzer(tag, conn)	{ pia = 0; }
 
 	virtual void Done();
-	virtual void UpdateEndpointVal(RecordVal* endp, int is_orig) = 0;
 	virtual bool IsReuse(double t, const u_char* pkt) = 0;
 
 	virtual void SetContentsFile(unsigned int direction, BroFile* f);
diff --git a/src/AnalyzerTags.h b/src/AnalyzerTags.h
index 509a7d122f..aaf7b733cb 100644
--- a/src/AnalyzerTags.h
+++ b/src/AnalyzerTags.h
@@ -22,7 +22,9 @@ namespace AnalyzerTag {
 		PIA_TCP, PIA_UDP,
 
 		// Transport-layer analyzers.
-		ICMP, ICMP_TimeExceeded, ICMP_Unreachable, ICMP_Echo, TCP, UDP,
+		ICMP,
+		ICMP_TimeExceeded, ICMP_Unreachable, ICMP_Echo, ICMP_Redir,
+		TCP, UDP,
 
 		// Application-layer analyzers (hand-written).
 		BitTorrent, BitTorrentTracker,
@@ -37,6 +39,8 @@ namespace AnalyzerTag {
 
 		// Other
 		File, Backdoor, InterConn, SteppingStone, TCPStats,
+		ConnSize,
+
 
 		// Support-analyzers
 		Contents, ContentLine, NVT, Zip, Contents_DNS, Contents_NCP,
diff --git a/src/Attr.cc b/src/Attr.cc
index 5cf36a643a..73685ec8fa 100644
--- a/src/Attr.cc
+++ b/src/Attr.cc
@@ -19,7 +19,7 @@ const char* attr_name(attr_tag t)
 		"&persistent", "&synchronized", "&postprocessor",
 		"&encrypt", "&match", "&disable_print_hook",
 		"&raw_output", "&mergeable", "&priority",
-		"&group", "(&tracked)",
+		"&group", "&log", "(&tracked)",
 	};
 
 	return attr_names[int(t)];
diff --git a/src/BitTorrentTracker.cc b/src/BitTorrentTracker.cc
index 50f6d0449c..aaf925f196 100644
--- a/src/BitTorrentTracker.cc
+++ b/src/BitTorrentTracker.cc
@@ -8,8 +8,8 @@
 #include <sys/types.h>
 #include <regex.h>
 
-# define FMT_INT "%lld"
-# define FMT_UINT "%llu"
+# define FMT_INT "%" PRId64
+# define FMT_UINT "%" PRIu64
 
 static TableType* bt_tracker_headers = 0;
 static RecordType* bittorrent_peer;
diff --git a/src/BroBifDoc.cc b/src/BroBifDoc.cc
deleted file mode 100644
index ff16ee8fde..0000000000
--- a/src/BroBifDoc.cc
+++ /dev/null
@@ -1,16 +0,0 @@
-#include <cstdio>
-#include <string>
-#include <list>
-
-#include "BroDoc.h"
-#include "BroBifDoc.h"
-
-BroBifDoc::BroBifDoc(const std::string& sourcename) : BroDoc(sourcename)
-	{
-	}
-
-// TODO: This needs to do something different than parent class's version.
-void BroBifDoc::WriteDocFile() const
-	{
-	BroDoc::WriteDocFile();
-	}
diff --git a/src/BroBifDoc.h b/src/BroBifDoc.h
deleted file mode 100644
index 724f50c4bd..0000000000
--- a/src/BroBifDoc.h
+++ /dev/null
@@ -1,18 +0,0 @@
-#ifndef brobifdoc_h
-#define brobifdoc_h
-
-#include <cstdio>
-#include <string>
-#include <list>
-
-#include "BroDoc.h"
-
-class BroBifDoc : public BroDoc {
-public:
-	BroBifDoc(const std::string& sourcename);
-	virtual ~BroBifDoc()	{ }
-
-	void WriteDocFile() const;
-};
-
-#endif
diff --git a/src/BroDoc.cc b/src/BroDoc.cc
index 5074c8b1e8..6958e645cb 100644
--- a/src/BroDoc.cc
+++ b/src/BroDoc.cc
@@ -58,15 +58,8 @@ void BroDoc::AddImport(const std::string& s)
 
 	if ( ext_pos == std::string::npos )
 		imports.push_back(s);
-
 	else
-		{
-		if ( s.substr(ext_pos + 1) == "bro" )
-			imports.push_back(s.substr(0, ext_pos));
-		else
-			fprintf(stderr, "Warning: skipped documenting @load of file "
-			                "without .bro extension: %s\n", s.c_str());
-		}
+		imports.push_back(s.substr(0, ext_pos));
 	}
 
 void BroDoc::SetPacketFilter(const std::string& s)
@@ -116,7 +109,15 @@ void BroDoc::WriteDocFile() const
 	if ( ! imports.empty() )
 		{
 		WriteToDoc(":Imports: ");
-		WriteStringList(":doc:`%s`, ", ":doc:`%s`\n", imports);
+		std::list<std::string>::const_iterator it;
+		for ( it = imports.begin(); it != imports.end(); ++it )
+			{
+			if ( it != imports.begin() )
+				WriteToDoc(", ");
+
+			WriteToDoc(":doc:`%s </policy/%s>`", it->c_str(), it->c_str());
+			}
+		WriteToDoc("\n");
 		}
 
 	WriteToDoc("\n");
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index 71d4e231a9..70c140d9f6 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -285,7 +285,6 @@ set(bro_SRCS
     BitTorrent.cc
     BitTorrentTracker.cc
     BPF_Program.cc
-    BroBifDoc.cc
     BroDoc.cc
     BroDocObj.cc
     BroString.cc
@@ -294,6 +293,7 @@ set(bro_SRCS
     CompHash.cc
     Conn.cc
     ConnCompressor.cc
+    ConnSizeAnalyzer.cc
     ContentLine.cc
     DCE_RPC.cc
     DFA.cc
diff --git a/src/ChunkedIO.cc b/src/ChunkedIO.cc
index 0db5675766..9ca8f23508 100644
--- a/src/ChunkedIO.cc
+++ b/src/ChunkedIO.cc
@@ -9,6 +9,8 @@
 #include <assert.h>
 #include <openssl/ssl.h>
 
+#include <algorithm>
+
 #include "config.h"
 #include "ChunkedIO.h"
 #include "NetVar.h"
@@ -140,7 +142,7 @@ bool ChunkedIOFd::Write(Chunk* chunk)
 	{
 #ifdef DEBUG
 	DBG_LOG(DBG_CHUNKEDIO, "write of size %d [%s]",
-		chunk->len, fmt_bytes(chunk->data, min(20, chunk->len)));
+		chunk->len, fmt_bytes(chunk->data, min((uint32)20, chunk->len)));
 #endif
 
 	// Reject if our queue of pending chunks is way too large. Otherwise,
@@ -166,13 +168,13 @@ bool ChunkedIOFd::Write(Chunk* chunk)
 
 	// We have to split it up.
 	char* p = chunk->data;
-	unsigned long left = chunk->len;
+	uint32 left = chunk->len;
 
 	while ( left )
 		{
 		Chunk* part = new Chunk;
 
-		part->len = min(BUFFER_SIZE - sizeof(uint32), left);
+		part->len = min<uint32>(BUFFER_SIZE - sizeof(uint32), left);
 		part->data = new char[part->len];
 		memcpy(part->data, p, part->len);
 		left -= part->len;
@@ -427,7 +429,7 @@ bool ChunkedIOFd::Read(Chunk** chunk, bool may_block)
 				(*chunk)->len & ~FLAG_PARTIAL,
 				(*chunk)->len & FLAG_PARTIAL ? "(P) " : "",
 				fmt_bytes((*chunk)->data,
-						min(20, (*chunk)->len)));
+						min((uint32)20, (*chunk)->len)));
 #endif
 
 	if ( ! ((*chunk)->len & FLAG_PARTIAL) )
diff --git a/src/Conn.cc b/src/Conn.cc
index 7758ac03f0..8ef756b134 100644
--- a/src/Conn.cc
+++ b/src/Conn.cc
@@ -152,7 +152,6 @@ Connection::Connection(NetSessions* s, HashKey* k, double t, const ConnID* id)
 	proto = TRANSPORT_UNKNOWN;
 
 	conn_val = 0;
-	orig_endp = resp_endp = 0;
 	login_conn = 0;
 
 	is_active = 1;
@@ -182,6 +181,8 @@ Connection::Connection(NetSessions* s, HashKey* k, double t, const ConnID* id)
 	TimerMgr::Tag* tag = current_iosrc->GetCurrentTag();
 	conn_timer_mgr = tag ? new TimerMgr::Tag(*tag) : 0;
 
+	uid = 0; // Will set later.
+
 	if ( conn_timer_mgr )
 		{
 		++external_connections;
@@ -215,6 +216,56 @@ Connection::~Connection()
 		--external_connections;
 	}
 
+uint64 Connection::uid_counter = 0;
+uint64 Connection::uid_instance = 0;
+
+uint64 Connection::CalculateNextUID()
+	{
+	if ( uid_instance == 0 )
+		{
+		// This is the first time we need a UID.
+
+		if ( ! have_random_seed() )
+			{
+			// If we don't need deterministic output (as
+			// indicated by a set seed), we calculate the
+			// instance ID by hashing something likely to be
+			// globally unique.
+			struct {
+				char hostname[128];
+				struct timeval time;
+				pid_t pid;
+				int rnd;
+			} unique;
+
+			gethostname(unique.hostname, 128);
+			unique.hostname[sizeof(unique.hostname)-1] = '\0';
+			gettimeofday(&unique.time, 0);
+			unique.pid = getpid();
+			unique.rnd = bro_random();
+
+			uid_instance = HashKey::HashBytes(&unique, sizeof(unique));
+			++uid_instance; // Now it's larger than zero.
+			}
+
+		else
+			// Generate determistic UIDs.
+			uid_instance = 1;
+		}
+
+	// Now calculate the unique ID for this connection.
+	struct {
+		uint64 counter;
+		hash_t instance;
+	} key;
+
+	key.counter = ++uid_counter;
+	key.instance = uid_instance;
+
+	uint64_t h = HashKey::HashBytes(&key, sizeof(key));
+	return h;
+	}
+
 void Connection::Done()
 	{
 	finished = 1;
@@ -346,14 +397,15 @@ RecordVal* Connection::BuildConnVal()
 		id_val->Assign(1, new PortVal(ntohs(orig_port), prot_type));
 		id_val->Assign(2, new AddrVal(resp_addr));
 		id_val->Assign(3, new PortVal(ntohs(resp_port), prot_type));
+
 		conn_val->Assign(0, id_val);
 
-		orig_endp = new RecordVal(endpoint);
+		RecordVal *orig_endp = new RecordVal(endpoint);
 		orig_endp->Assign(0, new Val(0, TYPE_COUNT));
 		orig_endp->Assign(1, new Val(0, TYPE_COUNT));
 		conn_val->Assign(1, orig_endp);
 
-		resp_endp = new RecordVal(endpoint);
+		RecordVal *resp_endp = new RecordVal(endpoint);
 		resp_endp->Assign(0, new Val(0, TYPE_COUNT));
 		resp_endp->Assign(1, new Val(0, TYPE_COUNT));
 		conn_val->Assign(2, resp_endp);
@@ -363,13 +415,16 @@ RecordVal* Connection::BuildConnVal()
 		conn_val->Assign(6, new StringVal(""));	// addl
 		conn_val->Assign(7, new Val(0, TYPE_COUNT));	// hot
 		conn_val->Assign(8, new StringVal(""));	// history
+
+		if ( ! uid )
+			uid = CalculateNextUID();
+
+		char tmp[20];
+		conn_val->Assign(9, new StringVal(uitoa_n(uid, tmp, sizeof(tmp), 62)));
 		}
 
 	if ( root_analyzer )
-		{
-		root_analyzer->UpdateEndpointVal(orig_endp, 1);
-		root_analyzer->UpdateEndpointVal(resp_endp, 0);
-		}
+		root_analyzer->UpdateConnVal(conn_val);
 
 	conn_val->Assign(3, new Val(start_time, TYPE_TIME));	// ###
 	conn_val->Assign(4, new Val(last_time - start_time, TYPE_INTERVAL));
@@ -744,10 +799,6 @@ void Connection::FlipRoles()
 	resp_port = orig_port;
 	orig_port = tmp_port;
 
-	RecordVal* tmp_rc = resp_endp;
-	resp_endp = orig_endp;
-	orig_endp = tmp_rc;
-
 	Unref(conn_val);
 	conn_val = 0;
 
@@ -843,8 +894,6 @@ bool Connection::DoSerialize(SerialInfo* info) const
 			return false;
 
 	SERIALIZE_OPTIONAL(conn_val);
-	SERIALIZE_OPTIONAL(orig_endp);
-	SERIALIZE_OPTIONAL(resp_endp);
 
 	// FIXME: RuleEndpointState not yet serializable.
 	// FIXME: Analyzers not yet serializable.
@@ -908,10 +957,6 @@ bool Connection::DoUnserialize(UnserialInfo* info)
 
 	UNSERIALIZE_OPTIONAL(conn_val,
 			(RecordVal*) Val::Unserialize(info, connection_type));
-	UNSERIALIZE_OPTIONAL(orig_endp,
-			(RecordVal*) Val::Unserialize(info, endpoint));
-	UNSERIALIZE_OPTIONAL(resp_endp,
-			(RecordVal*) Val::Unserialize(info, endpoint));
 
 	int iproto;
 
diff --git a/src/Conn.h b/src/Conn.h
index 473b8416ef..8a178d783a 100644
--- a/src/Conn.h
+++ b/src/Conn.h
@@ -301,7 +301,12 @@ public:
 			::operator delete(((char*) ptr) - 4);
 		}
 
+	void SetUID(uint64 arg_uid)	 { uid = arg_uid; }
+
+	static uint64 CalculateNextUID();
+
 protected:
+
 	Connection()	{ persistent = 0; }
 
 	// Add the given timer to expire at time t.  If do_expire
@@ -333,8 +338,6 @@ protected:
 	double start_time, last_time;
 	double inactivity_timeout;
 	RecordVal* conn_val;
-	RecordVal* orig_endp;
-	RecordVal* resp_endp;
 	LoginConn* login_conn;	// either nil, or this
 	int suppress_event;	// suppress certain events to once per conn.
 
@@ -358,6 +361,11 @@ protected:
 
 	TransportLayerAnalyzer* root_analyzer;
 	PIA* primary_PIA;
+
+	uint64 uid;	// Globally unique connection ID.
+
+	static uint64 uid_counter;	// Counter for uids.
+	static uint64 uid_instance;	// Instance ID, computed once.
 };
 
 class ConnectionTimer : public Timer {
diff --git a/src/ConnCompressor.cc b/src/ConnCompressor.cc
index 9d847a504c..e6428aeebe 100644
--- a/src/ConnCompressor.cc
+++ b/src/ConnCompressor.cc
@@ -4,6 +4,7 @@
 
 #include "ConnCompressor.h"
 #include "Event.h"
+#include "ConnSizeAnalyzer.h"
 #include "net_util.h"
 
 // The basic model of the compressor is to wait for an answer before
@@ -45,6 +46,11 @@
 // - We don't match signatures on connections which are completely handled
 //   by the compressor. Matching would require significant additional state
 //   w/o being very helpful.
+//
+// - If use_conn_size_analyzer is True, the reported counts for bytes and
+//   packets may not account for some packets/data that is part of those
+//   packets which the connection compressor handles. The error, if any, will
+//   however be small.
 
 
 #ifdef DEBUG
@@ -234,7 +240,7 @@ Connection* ConnCompressor::NextPacket(double t, HashKey* key, const IP_Hdr* ip,
 	else if ( addr_eq(ip->SrcAddr(), SrcAddr(pending)) &&
 		  tp->th_sport == SrcPort(pending) )
 		// Another packet from originator.
-		tc = NextFromOrig(pending, t, key, tp);
+		tc = NextFromOrig(pending, t, key, ip, tp);
 
 	else
 		// A reply.
@@ -329,11 +335,15 @@ Connection* ConnCompressor::FirstFromOrig(double t, HashKey* key,
 	}
 
 Connection* ConnCompressor::NextFromOrig(PendingConn* pending, double t,
-						HashKey* key, const tcphdr* tp)
+						HashKey* key, const IP_Hdr* ip,
+						const tcphdr* tp)
 	{
 	// Another packet from the same host without seeing an answer so far.
 	DBG_LOG(DBG_COMPRESSOR, "%s same again", fmt_conn_id(pending));
 
+	++pending->num_pkts;
+	++pending->num_bytes_ip += ip->PayloadLen();
+
 	// New window scale overrides old - not great, this is a (subtle)
 	// evasion opportunity.
 	if ( TCP_Analyzer::ParseTCPOptions(tp, parse_tcp_options, 0, 0,
@@ -521,6 +531,8 @@ Connection* ConnCompressor::Instantiate(HashKey* key, PendingConn* pending)
 		return 0;
 		}
 
+	new_conn->SetUID(pending->uid);
+
 	DBG_LOG(DBG_COMPRESSOR, "%s instantiated", fmt_conn_id(pending));
 
 	++sizes.connections;
@@ -608,6 +620,9 @@ void ConnCompressor::PktHdrToPendingConn(double time, const HashKey* key,
 	c->FIN = (tp->th_flags & TH_FIN) != 0;
 	c->RST = (tp->th_flags & TH_RST) != 0;
 	c->ACK = (tp->th_flags & TH_ACK) != 0;
+	c->uid = Connection::CalculateNextUID();
+	c->num_bytes_ip = ip->TotalLen();
+	c->num_pkts = 1;
 	c->invalid = 0;
 
 	if ( TCP_Analyzer::ParseTCPOptions(tp, parse_tcp_options, 0, 0, c) < 0 )
@@ -848,8 +863,23 @@ void ConnCompressor::Event(const PendingConn* pending, double t,
 							TRANSPORT_TCP));
 			orig_endp->Assign(0, new Val(orig_size, TYPE_COUNT));
 			orig_endp->Assign(1, new Val(orig_state, TYPE_COUNT));
+
+			if ( ConnSize_Analyzer::Available() )
+				{
+				orig_endp->Assign(2, new Val(pending->num_pkts, TYPE_COUNT));
+				orig_endp->Assign(3, new Val(pending->num_bytes_ip, TYPE_COUNT));
+				}
+			else
+				{
+				orig_endp->Assign(2, new Val(0, TYPE_COUNT));
+				orig_endp->Assign(3, new Val(0, TYPE_COUNT));
+				}
+
+
 			resp_endp->Assign(0, new Val(0, TYPE_COUNT));
 			resp_endp->Assign(1, new Val(resp_state, TYPE_COUNT));
+			resp_endp->Assign(2, new Val(0, TYPE_COUNT));
+			resp_endp->Assign(3, new Val(0, TYPE_COUNT));
 			}
 		else
 			{
@@ -859,10 +889,26 @@ void ConnCompressor::Event(const PendingConn* pending, double t,
 			id_val->Assign(2, new AddrVal(SrcAddr(pending)));
 			id_val->Assign(3, new PortVal(ntohs(SrcPort(pending)),
 							TRANSPORT_TCP));
+
 			orig_endp->Assign(0, new Val(0, TYPE_COUNT));
 			orig_endp->Assign(1, new Val(resp_state, TYPE_COUNT));
+			orig_endp->Assign(2, new Val(0, TYPE_COUNT));
+			orig_endp->Assign(3, new Val(0, TYPE_COUNT));
+
 			resp_endp->Assign(0, new Val(orig_size, TYPE_COUNT));
 			resp_endp->Assign(1, new Val(orig_state, TYPE_COUNT));
+
+			if ( ConnSize_Analyzer::Available() )
+				{
+				resp_endp->Assign(2, new Val(pending->num_pkts, TYPE_COUNT));
+				resp_endp->Assign(3, new Val(pending->num_bytes_ip, TYPE_COUNT));
+				}
+			else
+				{
+				resp_endp->Assign(2, new Val(0, TYPE_COUNT));
+				resp_endp->Assign(3, new Val(0, TYPE_COUNT));
+				}
+
 			DBG_LOG(DBG_COMPRESSOR, "%s swapped direction", fmt_conn_id(pending));
 			}
 
@@ -877,6 +923,9 @@ void ConnCompressor::Event(const PendingConn* pending, double t,
 		conn_val->Assign(7, new Val(0, TYPE_COUNT));	// hot
 		conn_val->Assign(8, new StringVal(""));	// history
 
+		char tmp[20]; // uid.
+		conn_val->Assign(9, new StringVal(uitoa_n(pending->uid, tmp, sizeof(tmp), 62)));
+
 		conn_val->SetOrigin(0);
 		}
 
diff --git a/src/ConnCompressor.h b/src/ConnCompressor.h
index a76a35134a..040a120ba9 100644
--- a/src/ConnCompressor.h
+++ b/src/ConnCompressor.h
@@ -97,6 +97,11 @@ public:
 		uint32 ack;
 		hash_t hash;
 		uint16 window;
+		uint64 uid;
+
+		// The following are set if use_conn_size_analyzer is T.
+		uint16 num_pkts;
+		uint16 num_bytes_ip;
 	};
 
 private:
@@ -118,8 +123,8 @@ private:
 					const IP_Hdr* ip, const tcphdr* tp);
 
 	// Called for more packets from the orginator w/o seeing a response.
-	Connection* NextFromOrig(PendingConn* pending,
-				double t, HashKey* key, const tcphdr* tp);
+	Connection* NextFromOrig(PendingConn* pending, double t, HashKey* key,
+					const IP_Hdr* ip, const tcphdr* tp);
 
 	// Called for the first response packet. Instantiates a Connection.
 	Connection* Response(PendingConn* pending, double t, HashKey* key,
diff --git a/src/ConnSizeAnalyzer.cc b/src/ConnSizeAnalyzer.cc
new file mode 100644
index 0000000000..c98a9f6827
--- /dev/null
+++ b/src/ConnSizeAnalyzer.cc
@@ -0,0 +1,90 @@
+// $Id$
+//
+// See the file "COPYING" in the main distribution directory for copyright.
+//
+// See ConnSize.h for more extensive comments.
+
+
+#include "ConnSizeAnalyzer.h"
+#include "TCP.h"
+
+
+
+ConnSize_Analyzer::ConnSize_Analyzer(Connection* c)
+: Analyzer(AnalyzerTag::ConnSize, c)
+	{
+	}
+
+
+ConnSize_Analyzer::~ConnSize_Analyzer()
+	{
+	}
+
+void ConnSize_Analyzer::Init()
+	{
+	Analyzer::Init();
+
+	orig_bytes = 0;
+	orig_pkts = 0;
+	resp_bytes = 0;
+	resp_pkts = 0;
+	}
+
+void ConnSize_Analyzer::Done()
+	{
+	Analyzer::Done();
+	}
+
+void ConnSize_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig, int seq, const IP_Hdr* ip, int caplen)
+	{
+	Analyzer::DeliverPacket(len, data, is_orig, seq, ip, caplen);
+
+	if ( is_orig )
+		{
+		orig_bytes += ip->TotalLen();
+		orig_pkts ++;
+		}
+	else
+		{
+		resp_bytes += ip->TotalLen();
+		resp_pkts ++;
+		}
+	}
+
+void ConnSize_Analyzer::UpdateConnVal(RecordVal *conn_val)
+	{
+	// RecordType *connection_type is decleared in NetVar.h
+	int orig_endp_idx = connection_type->FieldOffset("orig");
+	int resp_endp_idx = connection_type->FieldOffset("resp");
+	RecordVal *orig_endp = conn_val->Lookup(orig_endp_idx)->AsRecordVal();
+	RecordVal *resp_endp = conn_val->Lookup(resp_endp_idx)->AsRecordVal();
+
+	// endpoint is the RecordType from NetVar.h
+	// TODO: or orig_endp->Type()->AsRecordVal()->FieldOffset()
+	int pktidx = endpoint->FieldOffset("num_pkts");
+	int bytesidx = endpoint->FieldOffset("num_bytes_ip");
+
+	// TODO: error handling?
+	orig_endp->Assign(pktidx, new Val(orig_pkts, TYPE_COUNT));
+	orig_endp->Assign(bytesidx, new Val(orig_bytes, TYPE_COUNT));
+	resp_endp->Assign(pktidx, new Val(resp_pkts, TYPE_COUNT));
+	resp_endp->Assign(bytesidx, new Val(resp_bytes, TYPE_COUNT));
+
+	Analyzer::UpdateConnVal(conn_val);
+	}
+
+
+void ConnSize_Analyzer::FlipRoles()
+	{
+	Analyzer::FlipRoles();
+	uint64_t tmp;
+
+	tmp = orig_bytes;
+	orig_bytes = resp_bytes;
+	resp_bytes = tmp;
+
+	tmp = orig_pkts;
+	orig_pkts = resp_pkts;
+	resp_pkts = tmp;
+	}
+
diff --git a/src/ConnSizeAnalyzer.h b/src/ConnSizeAnalyzer.h
new file mode 100644
index 0000000000..38446b0763
--- /dev/null
+++ b/src/ConnSizeAnalyzer.h
@@ -0,0 +1,41 @@
+// $Id$
+//
+// See the file "COPYING" in the main distribution directory for copyright.
+//
+
+#ifndef CONNSTATS_H
+#define CONNSTATS_H
+
+#include "Analyzer.h"
+#include "NetVar.h"
+
+
+class ConnSize_Analyzer : public Analyzer {
+public:
+	ConnSize_Analyzer(Connection* c);
+	virtual ~ConnSize_Analyzer();
+
+	virtual void Init();
+	virtual void Done();
+
+	// from Analyzer.h
+	virtual void UpdateConnVal(RecordVal *conn_val);
+	virtual void FlipRoles();
+
+	static Analyzer* InstantiateAnalyzer(Connection* conn)
+		{ return new ConnSize_Analyzer(conn); }
+
+	static bool Available()	{ return BifConst::use_conn_size_analyzer ; }
+
+protected:
+	virtual void DeliverPacket(int len, const u_char* data, bool is_orig,
+					int seq, const IP_Hdr* ip, int caplen);
+
+
+	uint64_t orig_bytes;
+	uint64_t resp_bytes;
+	uint64_t orig_pkts;
+	uint64_t resp_pkts;
+};
+
+#endif
diff --git a/src/ContentLine.cc b/src/ContentLine.cc
index 6dd772a0f8..4ab5d0358e 100644
--- a/src/ContentLine.cc
+++ b/src/ContentLine.cc
@@ -120,7 +120,7 @@ void ContentLine_Analyzer::EndpointEOF(bool is_orig)
 		DeliverStream(1, (const u_char*) "\n", is_orig);
 	}
 
-void ContentLine_Analyzer::SetPlainDelivery(int length)
+void ContentLine_Analyzer::SetPlainDelivery(int64_t length)
 	{
 	if ( length < 0 )
 		internal_error("negative length for plain delivery");
@@ -154,7 +154,7 @@ void ContentLine_Analyzer::DoDeliver(int len, const u_char* data)
 
 		if ( plain_delivery_length > 0 )
 			{
-			int deliver_plain = min(plain_delivery_length, len);
+			int deliver_plain = min(plain_delivery_length, (int64_t)len);
 
 			last_char = 0; // clear last_char
 			plain_delivery_length -= deliver_plain;
@@ -179,7 +179,7 @@ void ContentLine_Analyzer::DoDeliver(int len, const u_char* data)
 		if ( seq < seq_to_skip )
 			{
 			// Skip rest of the data and return
-			int skip_len = seq_to_skip - seq;
+			int64_t skip_len = seq_to_skip - seq;
 			if ( skip_len > len )
 				skip_len = len;
 
@@ -310,7 +310,7 @@ void ContentLine_Analyzer::CheckNUL()
 		}
 	}
 
-void ContentLine_Analyzer::SkipBytesAfterThisLine(int length)
+void ContentLine_Analyzer::SkipBytesAfterThisLine(int64_t length)
 	{
 	// This is a little complicated because Bro has to handle
 	// both CR and CRLF as a line break. When a line is delivered,
@@ -326,7 +326,7 @@ void ContentLine_Analyzer::SkipBytesAfterThisLine(int length)
 		SkipBytes(length);
 	}
 
-void ContentLine_Analyzer::SkipBytes(int length)
+void ContentLine_Analyzer::SkipBytes(int64_t length)
 	{
 	skip_pending = 0;
 	seq_to_skip = SeqDelivered() + length;
diff --git a/src/ContentLine.h b/src/ContentLine.h
index fe18ae9f95..25482ecc2f 100644
--- a/src/ContentLine.h
+++ b/src/ContentLine.h
@@ -44,16 +44,16 @@ public:
 	// mode for next <length> bytes.  Plain-delivery data is also passed
 	// via DeliverStream() and can differentiated by calling
 	// IsPlainDelivery().
-	void SetPlainDelivery(int length);
-	int GetPlainDeliveryLength() const	{ return plain_delivery_length; }
+	void SetPlainDelivery(int64_t length);
+	int64_t GetPlainDeliveryLength() const	{ return plain_delivery_length; }
 	bool IsPlainDelivery()			{ return is_plain; }
 
 	// Skip <length> bytes after this line.
 	// Can be used to skip HTTP data for performance considerations.
-	void SkipBytesAfterThisLine(int length);
-	void SkipBytes(int length);
+	void SkipBytesAfterThisLine(int64_t length);
+	void SkipBytes(int64_t length);
 
-	bool IsSkippedContents(int seq, int length)
+	bool IsSkippedContents(int64_t seq, int64_t length)
 		{ return seq + length <= seq_to_skip; }
 
 protected:
@@ -71,26 +71,26 @@ protected:
 	void CheckNUL();
 
 	// Returns the sequence number delivered so far.
-	int SeqDelivered() const	{ return seq_delivered_in_lines; }
+	int64_t SeqDelivered() const	{ return seq_delivered_in_lines; }
 
 	u_char* buf;	// where we build up the body of the request
 	int offset;	// where we are in buf
 	int buf_len;	// how big buf is, total
 	unsigned int last_char;	// last (non-option) character scanned
 
-	int seq;	// last seq number
-	int seq_to_skip;
+	int64_t seq;	// last seq number
+	int64_t seq_to_skip;
 
 	// Seq delivered up to through NewLine() -- it is adjusted
 	// *before* NewLine() is called.
-	int seq_delivered_in_lines;
+	int64_t seq_delivered_in_lines;
 
 	// Number of bytes to be skipped after this line. See
 	// comments in SkipBytesAfterThisLine().
-	int skip_pending;
+	int64_t skip_pending;
 
 	// Remaining bytes to deliver plain.
-	int plain_delivery_length;
+	int64_t plain_delivery_length;
 	int is_plain;
 
 	// Don't deliver further data.
diff --git a/src/DPM.cc b/src/DPM.cc
index 35111a38fa..95c219182e 100644
--- a/src/DPM.cc
+++ b/src/DPM.cc
@@ -10,6 +10,7 @@
 #include "BackDoor.h"
 #include "InterConn.h"
 #include "SteppingStone.h"
+#include "ConnSizeAnalyzer.h"
 
 
 ExpectedConn::ExpectedConn(const uint32* _orig, const uint32* _resp,
@@ -189,6 +190,8 @@ bool DPM::BuildInitialAnalyzerTree(TransportProto proto, Connection* conn,
 					const u_char* data)
 	{
 	TCP_Analyzer* tcp = 0;
+	UDP_Analyzer* udp = 0;
+	ICMP_Analyzer* icmp = 0;
 	TransportLayerAnalyzer* root = 0;
 	AnalyzerTag::Tag expected = AnalyzerTag::Error;
 	analyzer_map* ports = 0;
@@ -206,7 +209,7 @@ bool DPM::BuildInitialAnalyzerTree(TransportProto proto, Connection* conn,
 		break;
 
 	case TRANSPORT_UDP:
-		root = new UDP_Analyzer(conn);
+		root = udp = new UDP_Analyzer(conn);
 		pia = new PIA_UDP(conn);
 		expected = GetExpected(proto, conn);
 		ports = &udp_ports;
@@ -221,15 +224,23 @@ bool DPM::BuildInitialAnalyzerTree(TransportProto proto, Connection* conn,
 		case ICMP_ECHOREPLY:
 			if ( ICMP_Echo_Analyzer::Available() )
 				{
-				root = new ICMP_Echo_Analyzer(conn);
+				root = icmp = new ICMP_Echo_Analyzer(conn);
 				DBG_DPD(conn, "activated ICMP Echo analyzer");
 				}
 			break;
 
+		case ICMP_REDIRECT:
+			if ( ICMP_Redir_Analyzer::Available() )
+				{
+				root = new ICMP_Redir_Analyzer(conn);
+				DBG_DPD(conn, "activated ICMP Redir analyzer");
+				}
+			break;
+
 		case ICMP_UNREACH:
 			if ( ICMP_Unreachable_Analyzer::Available() )
 				{
-				root = new ICMP_Unreachable_Analyzer(conn);
+				root = icmp = new ICMP_Unreachable_Analyzer(conn);
 				DBG_DPD(conn, "activated ICMP Unreachable analyzer");
 				}
 			break;
@@ -237,14 +248,14 @@ bool DPM::BuildInitialAnalyzerTree(TransportProto proto, Connection* conn,
 		case ICMP_TIMXCEED:
 			if ( ICMP_TimeExceeded_Analyzer::Available() )
 				{
-				root = new ICMP_TimeExceeded_Analyzer(conn);
+				root = icmp = new ICMP_TimeExceeded_Analyzer(conn);
 				DBG_DPD(conn, "activated ICMP Time Exceeded analyzer");
 				}
 			break;
 		}
 
 		if ( ! root )
-			root = new ICMP_Analyzer(conn);
+			root = icmp = new ICMP_Analyzer(conn);
 
 		analyzed = true;
 		break;
@@ -363,6 +374,16 @@ bool DPM::BuildInitialAnalyzerTree(TransportProto proto, Connection* conn,
 		// we cannot add it as a normal child.
 		if ( TCPStats_Analyzer::Available() )
 			tcp->AddChildPacketAnalyzer(new TCPStats_Analyzer(conn));
+
+		// Add ConnSize analyzer. Needs to see packets, not stream.
+		if ( ConnSize_Analyzer::Available() )
+			tcp->AddChildPacketAnalyzer(new ConnSize_Analyzer(conn));
+		}
+
+	else
+		{
+		if ( ConnSize_Analyzer::Available() )
+			root->AddChildAnalyzer(new ConnSize_Analyzer(conn), false);
 		}
 
 	if ( pia )
@@ -381,7 +402,7 @@ bool DPM::BuildInitialAnalyzerTree(TransportProto proto, Connection* conn,
 	if ( expected != AnalyzerTag::Error  )
 		conn->Event(expected_connection_seen, 0,
 				new Val(expected, TYPE_COUNT));
-	
+
 	return true;
 	}
 
diff --git a/src/Desc.cc b/src/Desc.cc
index 15db73d7c7..ce6083800c 100644
--- a/src/Desc.cc
+++ b/src/Desc.cc
@@ -127,7 +127,7 @@ void ODesc::Add(int64 i)
 	else
 		{
 		char tmp[256];
-		sprintf(tmp, "%lld", i);
+		sprintf(tmp, "%" PRId64, i);
 		Add(tmp);
 		}
 	}
@@ -139,7 +139,7 @@ void ODesc::Add(uint64 u)
 	else
 		{
 		char tmp[256];
-		sprintf(tmp, "%llu", u);
+		sprintf(tmp, "%" PRIu64, u);
 		Add(tmp);
 		}
 	}
diff --git a/src/Expr.cc b/src/Expr.cc
index 71b94c7aa7..c3589facca 100644
--- a/src/Expr.cc
+++ b/src/Expr.cc
@@ -494,8 +494,7 @@ Val* UnaryExpr::Eval(Frame* f) const
 		VectorVal* v_op = v->AsVectorVal();
 		VectorVal* result = new VectorVal(Type()->AsVectorType());
 
-		for ( unsigned int i = VECTOR_MIN;
-		      i < v_op->Size() + VECTOR_MIN; ++i )
+		for ( unsigned int i = 0; i < v_op->Size(); ++i )
 			{
 			Val* v_i = v_op->Lookup(i);
 			result->Assign(i, v_i ? Fold(v_i) : 0, this);
@@ -633,8 +632,7 @@ Val* BinaryExpr::Eval(Frame* f) const
 
 		VectorVal* v_result = new VectorVal(Type()->AsVectorType());
 
-		for ( unsigned int i = VECTOR_MIN;
-		      i < v_op1->Size() + VECTOR_MIN; ++i )
+		for ( unsigned int i = 0; i < v_op1->Size(); ++i )
 			{
 			if ( v_op1->Lookup(i) && v_op2->Lookup(i) )
 				v_result->Assign(i,
@@ -656,8 +654,7 @@ Val* BinaryExpr::Eval(Frame* f) const
 		VectorVal* vv = (is_vec1 ? v1 : v2)->AsVectorVal();
 		VectorVal* v_result = new VectorVal(Type()->AsVectorType());
 
-		for ( unsigned int i = VECTOR_MIN;
-		      i < vv->Size() + VECTOR_MIN; ++i )
+		for ( unsigned int i = 0; i < vv->Size(); ++i )
 			{
 			Val* vv_i = vv->Lookup(i);
 			if ( vv_i )
@@ -1063,8 +1060,7 @@ Val* IncrExpr::Eval(Frame* f) const
 	if ( is_vector(v) )
 		{
 		VectorVal* v_vec = v->AsVectorVal();
-		for ( unsigned int i = VECTOR_MIN;
-		      i < v_vec->Size() + VECTOR_MIN; ++i )
+		for ( unsigned int i = 0; i < v_vec->Size(); ++i )
 			{
 			Val* elt = v_vec->Lookup(i);
 			if ( elt )
@@ -1941,7 +1937,7 @@ Val* BoolExpr::Eval(Frame* f) const
 			{
 			result = new VectorVal(Type()->AsVectorType());
 			result->Resize(vector_v->Size());
-			result->AssignRepeat(VECTOR_MIN, result->Size(),
+			result->AssignRepeat(0, result->Size(),
 						scalar_v, this);
 			}
 		else
@@ -1970,8 +1966,7 @@ Val* BoolExpr::Eval(Frame* f) const
 	VectorVal* result = new VectorVal(Type()->AsVectorType());
 	result->Resize(vec_v1->Size());
 
-	for ( unsigned int i = VECTOR_MIN;
-	      i < vec_v1->Size() + VECTOR_MIN; ++i )
+	for ( unsigned int i = 0; i < vec_v1->Size(); ++i )
 		{
 		Val* op1 = vec_v1->Lookup(i);
 		Val* op2 = vec_v2->Lookup(i);
@@ -2353,7 +2348,7 @@ Val* CondExpr::Eval(Frame* f) const
 	VectorVal* result = new VectorVal(Type()->AsVectorType());
 	result->Resize(cond->Size());
 
-	for ( unsigned int i = VECTOR_MIN; i < cond->Size() + VECTOR_MIN; ++i )
+	for ( unsigned int i = 0; i < cond->Size(); ++i )
 		{
 		Val* local_cond = cond->Lookup(i);
 		if ( local_cond )
@@ -2951,8 +2946,7 @@ Val* IndexExpr::Eval(Frame* f) const
 				return 0;
 				}
 
-			for ( unsigned int i = VECTOR_MIN;
-			      i < v_v2->Size() + VECTOR_MIN; ++i )
+			for ( unsigned int i = 0; i < v_v2->Size(); ++i )
 				{
 				if ( v_v2->Lookup(i)->AsBool() )
 					v_result->Assign(v_result->Size() + 1, v_v1->Lookup(i), this);
@@ -2964,8 +2958,7 @@ Val* IndexExpr::Eval(Frame* f) const
 			// S does, i.e., by excluding those elements.
 			// Probably only do this if *all* are negative.
 			v_result->Resize(v_v2->Size());
-			for ( unsigned int i = VECTOR_MIN;
-			      i < v_v2->Size() + VECTOR_MIN; ++i )
+			for ( unsigned int i = 0; i < v_v2->Size(); ++i )
 				v_result->Assign(i, v_v1->Lookup(v_v2->Lookup(i)->CoerceToInt()), this);
 			}
 		}
@@ -3113,9 +3106,14 @@ Expr* FieldExpr::Simplify(SimplifyType simp_type)
 	return this;
 	}
 
+int FieldExpr::CanDel() const
+	{
+	return td->FindAttr(ATTR_DEFAULT) || td->FindAttr(ATTR_OPTIONAL);
+	}
+
 void FieldExpr::Assign(Frame* f, Val* v, Opcode opcode)
 	{
-	if ( IsError() || ! v )
+	if ( IsError() )
 		return;
 
 	if ( field < 0 )
@@ -3130,6 +3128,11 @@ void FieldExpr::Assign(Frame* f, Val* v, Opcode opcode)
 		}
 	}
 
+void FieldExpr::Delete(Frame* f)
+	{
+	Assign(f, 0, OP_ASSIGN_IDX);
+	}
+
 Val* FieldExpr::Fold(Val* v) const
 	{
 	Val* result = v->AsRecordVal()->Lookup(field);
@@ -3541,9 +3544,9 @@ Val* VectorConstructorExpr::Eval(Frame* f) const
 		{
 		Expr* e = exprs[i];
 		Val* v = e->Eval(f);
-		if ( ! vec->Assign(i + VECTOR_MIN, v, e) )
+		if ( ! vec->Assign(i, v, e) )
 			{
-			Error(fmt("type mismatch at index %d", i + VECTOR_MIN), e);
+			Error(fmt("type mismatch at index %d", i), e);
 			return 0;
 			}
 		}
@@ -3565,9 +3568,9 @@ Val* VectorConstructorExpr::InitVal(const BroType* t, Val* aggr) const
 		Expr* e = exprs[i];
 		Val* v = check_and_promote(e->Eval(0), vt, 1);
 
-		if ( ! v || ! vec->Assign(i + VECTOR_MIN, v, e) )
+		if ( ! v || ! vec->Assign(i, v, e) )
 			{
-			Error(fmt("initialization type mismatch at index %d", i + VECTOR_MIN), e);
+			Error(fmt("initialization type mismatch at index %d", i), e);
 			return 0;
 			}
 		}
@@ -3926,7 +3929,7 @@ Val* ArithCoerceExpr::Fold(Val* v) const
 
 	VectorVal* vv = v->AsVectorVal();
 	VectorVal* result = new VectorVal(Type()->AsVectorType());
-	for ( unsigned int i = VECTOR_MIN; i < vv->Size() + VECTOR_MIN; ++i )
+	for ( unsigned int i = 0; i < vv->Size(); ++i )
 		{
 		Val* elt = vv->Lookup(i);
 		if ( elt )
@@ -5043,9 +5046,9 @@ Val* ListExpr::InitVal(const BroType* t, Val* aggr) const
 			{
 			Expr* e = exprs[i];
 			Val* v = e->Eval(0);
-			if ( ! vec->Assign(i + VECTOR_MIN, v, e) )
+			if ( ! vec->Assign(i, v, e) )
 				{
-				e->Error(fmt("type mismatch at index %d",  i + VECTOR_MIN));
+				e->Error(fmt("type mismatch at index %d", i));
 				return 0;
 				}
 
diff --git a/src/Expr.h b/src/Expr.h
index 3d07f68df1..0f6ee67106 100644
--- a/src/Expr.h
+++ b/src/Expr.h
@@ -688,8 +688,11 @@ public:
 
 	int Field() const	{ return field; }
 
+	int CanDel() const;
+
 	Expr* Simplify(SimplifyType simp_type);
 	void Assign(Frame* f, Val* v, Opcode op = OP_ASSIGN);
+	void Delete(Frame* f);
 
 	Expr* MakeLvalue();
 
diff --git a/src/File.cc b/src/File.cc
index d2b9381ca0..a94b8706e7 100644
--- a/src/File.cc
+++ b/src/File.cc
@@ -735,7 +735,7 @@ int BroFile::Write(const char* data, int len)
 		while ( len )
 			{
 			int outl;
-			int inl = min(MIN_BUFFER_SIZE, len);
+			int inl = min(+MIN_BUFFER_SIZE, len);
 
 			if ( ! EVP_SealUpdate(cipher_ctx, cipher_buffer, &outl,
 						(unsigned char*)data, inl) )
diff --git a/src/Gnutella.cc b/src/Gnutella.cc
index 01a10f2969..5b1a2e39e8 100644
--- a/src/Gnutella.cc
+++ b/src/Gnutella.cc
@@ -238,7 +238,7 @@ void Gnutella_Analyzer::SendEvents(GnutellaMsgState* p, bool is_orig)
 		vl->append(new StringVal(p->payload));
 		vl->append(new Val(p->payload_len, TYPE_COUNT));
 		vl->append(new Val((p->payload_len <
-				    min(p->msg_len, GNUTELLA_MAX_PAYLOAD)),
+				    min(p->msg_len, (unsigned int)GNUTELLA_MAX_PAYLOAD)),
 				   TYPE_BOOL));
 		vl->append(new Val((p->payload_left == 0), TYPE_BOOL));
 
diff --git a/src/Gnutella.h b/src/Gnutella.h
index 74aed4523f..c390f418f4 100644
--- a/src/Gnutella.h
+++ b/src/Gnutella.h
@@ -29,7 +29,7 @@ public:
 	u_char msg_type;
 	u_char msg_ttl;
 	char payload[GNUTELLA_MAX_PAYLOAD];
-	int payload_len;
+	unsigned int payload_len;
 	unsigned int payload_left;
 };
 
diff --git a/src/HTTP.cc b/src/HTTP.cc
index 55e3c6d078..0c7e8e70e6 100644
--- a/src/HTTP.cc
+++ b/src/HTTP.cc
@@ -226,11 +226,11 @@ void HTTP_Entity::DeliverBodyClear(int len, const char* data, int trailing_CRLF)
 
 // Returns 1 if the undelivered bytes are completely within the body,
 // otherwise returns 0.
-int HTTP_Entity::Undelivered(int len)
+int HTTP_Entity::Undelivered(int64_t len)
 	{
 	if ( DEBUG_http )
 		{
-		DEBUG_MSG("Content gap %d, expect_data_length %d\n",
+		DEBUG_MSG("Content gap %" PRId64", expect_data_length %" PRId64 "\n",
 			  len, expect_data_length);
 		}
 
@@ -283,7 +283,7 @@ void HTTP_Entity::SubmitData(int len, const char* buf)
 		MIME_Entity::SubmitData(len, buf);
 	}
 
-void HTTP_Entity::SetPlainDelivery(int length)
+void HTTP_Entity::SetPlainDelivery(int64_t length)
 	{
 	ASSERT(length >= 0);
 	ASSERT(length == 0 || ! in_header);
@@ -302,7 +302,7 @@ void HTTP_Entity::SubmitHeader(MIME_Header* h)
 		data_chunk_t vt = h->get_value_token();
 		if ( ! is_null_data_chunk(vt) )
 			{
-			int n;
+			int64_t n;
 			if ( atoi_n(vt.length, vt.data, 0, 10, n) )
 				content_length = n;
 			else
@@ -409,7 +409,7 @@ void HTTP_Entity::SubmitAllHeaders()
 
 HTTP_Message::HTTP_Message(HTTP_Analyzer* arg_analyzer,
 				ContentLine_Analyzer* arg_cl, bool arg_is_orig,
-				int expect_body, int init_header_length)
+				int expect_body, int64_t init_header_length)
 : MIME_Message (arg_analyzer)
 	{
 	analyzer = arg_analyzer;
@@ -477,7 +477,7 @@ void HTTP_Message::Done(const int interrupted, const char* detail)
 		}
 	}
 
-int HTTP_Message::Undelivered(int len)
+int HTTP_Message::Undelivered(int64_t len)
 	{
 	if ( ! top_level )
 		return 0;
@@ -628,7 +628,7 @@ void HTTP_Message::SubmitEvent(int event_type, const char* detail)
 	MyHTTP_Analyzer()->HTTP_Event(category, detail);
 	}
 
-void HTTP_Message::SetPlainDelivery(int length)
+void HTTP_Message::SetPlainDelivery(int64_t length)
 	{
 	content_line->SetPlainDelivery(length);
 
@@ -701,7 +701,7 @@ void HTTP_Message::DeliverEntityData()
 	total_buffer_size = 0;
 	}
 
-int HTTP_Message::InitBuffer(int length)
+int HTTP_Message::InitBuffer(int64_t length)
 	{
 	if ( length <= 0 )
 		return 0;
@@ -1633,7 +1633,7 @@ void HTTP_Analyzer::HTTP_MessageDone(int is_orig, HTTP_Message* /* message */)
 	}
 
 void HTTP_Analyzer::InitHTTPMessage(ContentLine_Analyzer* cl, HTTP_Message*& message,
-		bool is_orig, int expect_body, int init_header_length)
+		bool is_orig, int expect_body, int64_t init_header_length)
 	{
 	if ( message )
 		{
diff --git a/src/HTTP.h b/src/HTTP.h
index 789224e4e1..4d621fa526 100644
--- a/src/HTTP.h
+++ b/src/HTTP.h
@@ -39,9 +39,9 @@ public:
 
 	void EndOfData();
 	void Deliver(int len, const char* data, int trailing_CRLF);
-	int Undelivered(int len);
-	int BodyLength() const 		{ return body_length; }
-	int HeaderLength() const 	{ return header_length; }
+	int Undelivered(int64_t len);
+	int64_t BodyLength() const 		{ return body_length; }
+	int64_t HeaderLength() const 	{ return header_length; }
 	void SkipBody() 		{ deliver_body = 0; }
 
 protected:
@@ -50,11 +50,11 @@ protected:
 
 	HTTP_Message* http_message;
 	int chunked_transfer_state;
-	int content_length;
-	int expect_data_length;
+	int64_t content_length;
+	int64_t expect_data_length;
 	int expect_body;
-	int body_length;
-	int header_length;
+	int64_t body_length;
+	int64_t header_length;
 	int deliver_body;
 	enum { IDENTITY, GZIP, COMPRESS, DEFLATE } encoding;
 #ifdef HAVE_LIBZ
@@ -68,7 +68,7 @@ protected:
 
 	void SubmitData(int len, const char* buf);
 
-	void SetPlainDelivery(int length);
+	void SetPlainDelivery(int64_t length);
 
 	void SubmitHeader(MIME_Header* h);
 	void SubmitAllHeaders();
@@ -94,12 +94,12 @@ enum {
 class HTTP_Message : public MIME_Message {
 public:
 	HTTP_Message(HTTP_Analyzer* analyzer, ContentLine_Analyzer* cl,
-			 bool is_orig, int expect_body, int init_header_length);
+			 bool is_orig, int expect_body, int64_t init_header_length);
 	~HTTP_Message();
 	void Done(const int interrupted, const char* msg);
 	void Done() { Done(0, "message ends normally"); }
 
-	int Undelivered(int len);
+	int Undelivered(int64_t len);
 
 	void BeginEntity(MIME_Entity* /* entity */);
 	void EndEntity(MIME_Entity* entity);
@@ -111,7 +111,7 @@ public:
 	void SubmitEvent(int event_type, const char* detail);
 
 	void SubmitTrailingHeaders(MIME_HeaderList& /* hlist */);
-	void SetPlainDelivery(int length);
+	void SetPlainDelivery(int64_t length);
 	void SkipEntityData();
 
 	HTTP_Analyzer* MyHTTP_Analyzer() const
@@ -135,16 +135,16 @@ protected:
 
 	double start_time;
 
-	int body_length;	// total length of entity bodies
-	int header_length;	// total length of headers, including the request/reply line
+	int64_t body_length;	// total length of entity bodies
+	int64_t header_length;	// total length of headers, including the request/reply line
 
 	// Total length of content gaps that are "successfully" skipped.
 	// Note: this might NOT include all content gaps!
-	int content_gap_length;
+	int64_t content_gap_length;
 
 	HTTP_Entity* current_entity;
 
-	int InitBuffer(int length);
+	int InitBuffer(int64_t length);
 	void DeliverEntityData();
 
 	Val* BuildMessageStat(const int interrupted, const char* msg);
@@ -191,7 +191,7 @@ protected:
 	int HTTP_ReplyLine(const char* line, const char* end_of_line);
 
 	void InitHTTPMessage(ContentLine_Analyzer* cl, HTTP_Message*& message, bool is_orig,
-				int expect_body, int init_header_length);
+				int expect_body, int64_t init_header_length);
 
 	const char* PrefixMatch(const char* line, const char* end_of_line,
 				const char* prefix);
diff --git a/src/Hash.h b/src/Hash.h
index a097bb58ec..d9659b442a 100644
--- a/src/Hash.h
+++ b/src/Hash.h
@@ -11,7 +11,7 @@
 
 #define UHASH_KEY_SIZE 32
 
-typedef unsigned int hash_t;
+typedef uint64 hash_t;
 
 typedef enum {
 	HASH_KEY_INT,
diff --git a/src/ICMP.cc b/src/ICMP.cc
index d73a9a781e..95169cd518 100644
--- a/src/ICMP.cc
+++ b/src/ICMP.cc
@@ -79,6 +79,9 @@ void ICMP_Analyzer::DeliverPacket(int arg_len, const u_char* data,
 
 	NextICMP(current_timestamp, icmpp, len, caplen, data);
 
+	if ( caplen >= len )
+		ForwardPacket(len, data, is_orig, seq, ip, caplen);
+
 	if ( rule_matcher )
 		matcher_state.Match(Rule::PAYLOAD, data, len, is_orig,
 					false, false, true);
@@ -252,6 +255,20 @@ void ICMP_Analyzer::Describe(ODesc* d) const
 	d->Add(dotted_addr(Conn()->RespAddr()));
 	}
 
+void ICMP_Analyzer::UpdateConnVal(RecordVal *conn_val)
+	{
+	int orig_endp_idx = connection_type->FieldOffset("orig");
+	int resp_endp_idx = connection_type->FieldOffset("resp");
+	RecordVal *orig_endp = conn_val->Lookup(orig_endp_idx)->AsRecordVal();
+	RecordVal *resp_endp = conn_val->Lookup(resp_endp_idx)->AsRecordVal();
+
+	UpdateEndpointVal(orig_endp, 1);
+	UpdateEndpointVal(resp_endp, 0);
+
+	// Call children's UpdateConnVal
+	Analyzer::UpdateConnVal(conn_val);
+	}
+
 void ICMP_Analyzer::UpdateEndpointVal(RecordVal* endp, int is_orig)
 	{
 	Conn()->EnableStatusUpdateTimer();
@@ -304,6 +321,24 @@ void ICMP_Echo_Analyzer::NextICMP(double t, const struct icmp* icmpp, int len,
 	ConnectionEvent(f, vl);
 	}
 
+ICMP_Redir_Analyzer::ICMP_Redir_Analyzer(Connection* c)
+: ICMP_Analyzer(AnalyzerTag::ICMP_Redir, c)
+	{
+	}
+
+void ICMP_Redir_Analyzer::NextICMP(double t, const struct icmp* icmpp, int len,
+					 int caplen, const u_char*& data)
+	{
+	uint32 addr = ntohl(icmpp->icmp_hun.ih_void);
+
+	val_list* vl = new val_list;
+	vl->append(BuildConnVal());
+	vl->append(BuildICMPVal());
+	vl->append(new AddrVal(htonl(addr)));
+
+	ConnectionEvent(icmp_redirect, vl);
+	}
+
 
 void ICMP_Context_Analyzer::NextICMP(double t, const struct icmp* icmpp,
 				int len, int caplen, const u_char*& data)
diff --git a/src/ICMP.h b/src/ICMP.h
index 43921f1aac..62b859beba 100644
--- a/src/ICMP.h
+++ b/src/ICMP.h
@@ -18,6 +18,8 @@ class ICMP_Analyzer : public TransportLayerAnalyzer {
 public:
 	ICMP_Analyzer(Connection* conn);
 
+	virtual void UpdateConnVal(RecordVal *conn_val);
+
 	static Analyzer* InstantiateAnalyzer(Connection* conn)
 		{ return new ICMP_Analyzer(conn); }
 
@@ -30,7 +32,6 @@ protected:
 	virtual void Done();
 	virtual void DeliverPacket(int len, const u_char* data, bool orig,
 					int seq, const IP_Hdr* ip, int caplen);
-	virtual void UpdateEndpointVal(RecordVal* endp, int is_orig);
 	virtual bool IsReuse(double t, const u_char* pkt);
 	virtual unsigned int MemoryAllocation() const;
 
@@ -52,6 +53,9 @@ protected:
 	int request_len, reply_len;
 
 	RuleMatcherState matcher_state;
+
+private:
+	void UpdateEndpointVal(RecordVal* endp, int is_orig);
 };
 
 class ICMP_Echo_Analyzer : public ICMP_Analyzer {
@@ -70,6 +74,22 @@ protected:
 	                      int len, int caplen, const u_char*& data);
 };
 
+class ICMP_Redir_Analyzer : public ICMP_Analyzer {
+public:
+	ICMP_Redir_Analyzer(Connection* conn);
+
+	static Analyzer* InstantiateAnalyzer(Connection* conn)
+		{ return new ICMP_Redir_Analyzer(conn); }
+
+	static bool Available()	{ return icmp_redirect; }
+
+protected:
+	ICMP_Redir_Analyzer()	{ }
+
+	virtual void NextICMP(double t, const struct icmp* icmpp,
+	                      int len, int caplen, const u_char*& data);
+};
+
 class ICMP_Context_Analyzer : public ICMP_Analyzer {
 public:
 	ICMP_Context_Analyzer(AnalyzerTag::Tag tag, Connection* conn)
diff --git a/src/LogMgr.cc b/src/LogMgr.cc
index 757db2183e..834829591a 100644
--- a/src/LogMgr.cc
+++ b/src/LogMgr.cc
@@ -1,5 +1,7 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
+#include <algorithm>
+
 #include "LogMgr.h"
 #include "Event.h"
 #include "EventHandler.h"
@@ -1051,7 +1053,7 @@ LogVal* LogMgr::ValToLogVal(Val* val, BroType* ty)
 		for ( int i = 0; i < lval->val.vector_val.size; i++ )
 			{
 			lval->val.vector_val.vals[i] =
-				ValToLogVal(vec->Lookup(VECTOR_MIN + i),
+				ValToLogVal(vec->Lookup(i),
 					    vec->Type()->YieldType());
 			}
 
diff --git a/src/Net.cc b/src/Net.cc
index acadd3b614..d9171d2ce1 100644
--- a/src/Net.cc
+++ b/src/Net.cc
@@ -51,7 +51,6 @@ int reading_live = 0;
 int reading_traces = 0;
 int have_pending_timers = 0;
 double pseudo_realtime = 0.0;
-char* user_pcap_filter = 0;
 bool using_communication = false;
 
 double network_time = 0.0;	// time according to last packet timestamp
diff --git a/src/Net.h b/src/Net.h
index 3f4dec1789..16d36791d2 100644
--- a/src/Net.h
+++ b/src/Net.h
@@ -58,9 +58,6 @@ extern int have_pending_timers;
 // is the speedup (1 = real-time, 0.5 = half real-time, etc.).
 extern double pseudo_realtime;
 
-// Pcap filter supplied by the user on the command line (if any).
-extern char* user_pcap_filter;
-
 // When we started processing the current packet and corresponding event
 // queue.
 extern double processing_start_time;
diff --git a/src/NetVar.cc b/src/NetVar.cc
index 5162f59ece..db16d714b8 100644
--- a/src/NetVar.cc
+++ b/src/NetVar.cc
@@ -259,6 +259,8 @@ int record_all_packets;
 RecordType* script_id;
 TableType* id_table;
 
+StringVal* cmd_line_bpf_filter;
+
 #include "const.bif.netvar_def"
 #include "types.bif.netvar_def"
 #include "event.bif.netvar_def"
@@ -312,6 +314,9 @@ void init_general_global_var()
 	trace_output_file = internal_val("trace_output_file")->AsStringVal();
 
 	record_all_packets = opt_internal_int("record_all_packets");
+
+	cmd_line_bpf_filter =
+		internal_val("cmd_line_bpf_filter")->AsStringVal();
 	}
 
 void init_net_var()
diff --git a/src/NetVar.h b/src/NetVar.h
index 135b626620..a3c0d8a33e 100644
--- a/src/NetVar.h
+++ b/src/NetVar.h
@@ -262,6 +262,8 @@ extern int record_all_packets;
 extern RecordType* script_id;
 extern TableType* id_table;
 
+extern StringVal* cmd_line_bpf_filter;
+
 // Initializes globals that don't pertain to network/event analysis.
 extern void init_general_global_var();
 
diff --git a/src/POP3.cc b/src/POP3.cc
index 4f1f2a5ea7..5d38b4c3d1 100644
--- a/src/POP3.cc
+++ b/src/POP3.cc
@@ -576,9 +576,11 @@ void POP3_Analyzer::ProcessReply(int length, const char* line)
 	if ( multiLine == true )
 		{
 		bool terminator =
-			length > 1 && line[0] == '.' &&
-			(line[1] == '\n' ||
-			 (length > 2 && line[1] == '\r' && line[2] == '\n'));
+			line[0] == '.' &&
+			(length == 1 ||
+			 (length > 1 &&
+			  (line[1] == '\n' ||
+			  (length > 2 && line[1] == '\r' && line[2] == '\n'))));
 
 		if ( terminator )
 			{
diff --git a/src/PktSrc.cc b/src/PktSrc.cc
index dea20c1396..d1f5eafba3 100644
--- a/src/PktSrc.cc
+++ b/src/PktSrc.cc
@@ -181,16 +181,98 @@ void PktSrc::Process()
 
 	current_timestamp = next_timestamp;
 
+	int pkt_hdr_size = hdr_size;
+
+	// Unfortunately some packets on the link might have MPLS labels
+	// while others don't. That means we need to ask the link-layer if
+	// labels are in place.
+	bool have_mpls = false;
+
+	int protocol = 0;
+
+	switch ( datalink ) {
+	case DLT_NULL:
+		{
+		protocol = (data[3] << 24) + (data[2] << 16) + (data[1] << 8) + data[0];
+
+		if ( protocol != AF_INET && protocol != AF_INET6 )
+			{
+			sessions->Weird("non_ip_packet_in_null_transport", &hdr, data);
+			data = 0;
+			return;
+			}
+
+		break;
+		}
+
+	case DLT_EN10MB:
+		{
+		// Get protocol being carried from the ethernet frame.
+		protocol = (data[12] << 8) + data[13];
+
+		// MPLS carried over the ethernet frame.
+		if ( protocol == 0x8847 )
+			have_mpls = true;
+
+		// VLAN carried over ethernet frame.
+		else if ( protocol == 0x8100 )
+			{
+			data += get_link_header_size(datalink);
+			data += 4; // Skip the vlan header
+			pkt_hdr_size = 0;
+			}
+
+		break;
+		}
+
+	case DLT_PPP_SERIAL:
+		{
+		// Get PPP protocol.
+		protocol = (data[2] << 8) + data[3];
+
+		if ( protocol == 0x0281 )
+			// MPLS Unicast
+			have_mpls = true;
+
+		else if ( protocol != 0x0021 && protocol != 0x0057 )
+			{
+			// Neither IPv4 nor IPv6.
+			sessions->Weird("non_ip_packet_in_ppp_encapsulation", &hdr, data);
+			data = 0;
+			return;
+			}
+		break;
+		}
+	}
+
+	if ( have_mpls )
+		{
+		// Remove the data link layer
+		data += get_link_header_size(datalink);
+
+		// Denote a header size of zero before the IP header
+		pkt_hdr_size = 0;
+
+		// Skip the MPLS label stack.
+		bool end_of_stack = false;
+
+		while ( ! end_of_stack )
+			{
+			end_of_stack = *(data + 2) & 0x01;
+			data += 4;
+			}
+		}
+
 	if ( pseudo_realtime )
 		{
 		current_pseudo = CheckPseudoTime();
-		net_packet_arrival(current_pseudo, &hdr, data, hdr_size, this);
+		net_packet_arrival(current_pseudo, &hdr, data, pkt_hdr_size, this);
 		if ( ! first_wallclock )
 			first_wallclock = current_time(true);
 		}
 
 	else
-		net_packet_arrival(current_timestamp, &hdr, data, hdr_size, this);
+		net_packet_arrival(current_timestamp, &hdr, data, pkt_hdr_size, this);
 
 	data = 0;
 	}
@@ -399,6 +481,11 @@ PktInterfaceSrc::PktInterfaceSrc(const char* arg_interface, const char* filter,
 	if ( PrecompileFilter(0, filter) && SetFilter(0) )
 		{
 		SetHdrSize();
+
+		if ( closed )
+			// Couldn't get header size.
+			return;
+
 		fprintf(stderr, "listening on %s\n", interface);
 		}
 	else
@@ -647,6 +734,9 @@ int get_link_header_size(int dl)
 		return 16;
 #endif
 
+	case DLT_PPP_SERIAL:	// PPP_SERIAL
+		return 4;
+
 	case DLT_RAW:
 		return 0;
 	}
diff --git a/src/RemoteSerializer.cc b/src/RemoteSerializer.cc
index 82b7dc7dde..6f33a33bca 100644
--- a/src/RemoteSerializer.cc
+++ b/src/RemoteSerializer.cc
@@ -173,6 +173,8 @@
 #endif
 #include <sys/resource.h>
 
+#include <algorithm>
+
 #include "RemoteSerializer.h"
 #include "Func.h"
 #include "EventRegistry.h"
@@ -2394,12 +2396,12 @@ bool RemoteSerializer::SendPrintHookEvent(BroFile* f, const char* txt)
 		if ( ! fname )
 			continue; // not a managed file.
 
-		int len = strlen(txt);
+		size_t len = strlen(txt);
 
 		// We cut off everything after the max buffer size.  That
 		// makes the code a bit easier, and we shouldn't have such
 		// long lines anyway.
-		len = min(len, PRINT_BUFFER_SIZE - strlen(fname) - 2);
+		len = min<size_t>(len, PRINT_BUFFER_SIZE - strlen(fname) - 2);
 
 		// If there's not enough space in the buffer, flush it.
 
diff --git a/src/SerializationFormat.cc b/src/SerializationFormat.cc
index c181107870..b9b3da5fef 100644
--- a/src/SerializationFormat.cc
+++ b/src/SerializationFormat.cc
@@ -21,6 +21,7 @@ void SerializationFormat::StartRead(char* data, uint32 arg_len)
 	input = data;
 	input_len = arg_len;
 	input_pos = 0;
+	bytes_read = 0;
 	}
 
 void SerializationFormat::EndRead()
@@ -44,7 +45,6 @@ void SerializationFormat::StartWrite()
 
 	output_pos = 0;
 	bytes_written = 0;
-	bytes_read = 0;
 	}
 
 uint32 SerializationFormat::EndWrite(char** data)
@@ -397,7 +397,7 @@ bool XMLSerializationFormat::Write(char v, const char* tag)
 
 bool XMLSerializationFormat::Write(uint16 v, const char* tag)
 	{
-	const char* tmp = fmt("%"PRIu16, v);
+	const char* tmp = fmt("%" PRIu16, v);
 	return WriteElem(tag, "uint16", tmp, strlen(tmp));
 	}
 
diff --git a/src/Serializer.h b/src/Serializer.h
index c8f9284b53..dde5c564e6 100644
--- a/src/Serializer.h
+++ b/src/Serializer.h
@@ -122,7 +122,7 @@ protected:
 
 	// This will be increased whenever there is an incompatible change
 	// in the data format.
-	static const uint32 DATA_FORMAT_VERSION = 18;
+	static const uint32 DATA_FORMAT_VERSION = 19;
 
 	ChunkedIO* io;
 
diff --git a/src/Sessions.cc b/src/Sessions.cc
index a0faf0f0e7..881a6c171d 100644
--- a/src/Sessions.cc
+++ b/src/Sessions.cc
@@ -220,7 +220,7 @@ void NetSessions::DispatchPacket(double t, const struct pcap_pkthdr* hdr,
 			}
 
 		else
-			// Blanket encapsulation (e.g., for VLAN).
+			// Blanket encapsulation
 			hdr_size += encap_hdr_size;
 		}
 
diff --git a/src/TCP.cc b/src/TCP.cc
index 67d516df7d..ea9d31e7a0 100644
--- a/src/TCP.cc
+++ b/src/TCP.cc
@@ -2,7 +2,7 @@
 //
 // See the file "COPYING" in the main distribution directory for copyright.
 
-
+#include "NetVar.h"
 #include "PIA.h"
 #include "File.h"
 #include "TCP.h"
@@ -922,9 +922,6 @@ int TCP_Analyzer::DeliverData(double t, const u_char* data, int len, int caplen,
 	int need_contents = endpoint->DataSent(t, data_seq,
 					len, caplen, data, ip, tp);
 
-	LOOP_OVER_GIVEN_CHILDREN(i, packet_children)
-		(*i)->NextPacket(len, data, is_orig, data_seq, ip, caplen);
-
 	return need_contents;
 	}
 
@@ -1053,6 +1050,12 @@ void TCP_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig,
 
 	CheckRecording(need_contents, flags);
 
+	// Handle child_packet analyzers.  Note: This happens *after* the
+	// packet has been processed and the TCP state updated.
+	LOOP_OVER_GIVEN_CHILDREN(i, packet_children)
+		(*i)->NextPacket(len, data, is_orig,
+				base_seq - endpoint->StartSeq(), ip, caplen);
+
 	if ( ! reassembling )
 		ForwardPacket(len, data, is_orig,
 				base_seq - endpoint->StartSeq(), ip, caplen);
@@ -1082,11 +1085,25 @@ void TCP_Analyzer::FlipRoles()
 	resp->is_orig = !resp->is_orig;
 	}
 
-void TCP_Analyzer::UpdateEndpointVal(RecordVal* endp, int is_orig)
+void TCP_Analyzer::UpdateConnVal(RecordVal *conn_val)
 	{
-	TCP_Endpoint* s = is_orig ? orig : resp;
-	endp->Assign(0, new Val(s->Size(), TYPE_COUNT));
-	endp->Assign(1, new Val(int(s->state), TYPE_COUNT));
+	int orig_endp_idx = connection_type->FieldOffset("orig");
+	int resp_endp_idx = connection_type->FieldOffset("resp");
+
+	RecordVal *orig_endp_val = conn_val->Lookup(orig_endp_idx)->AsRecordVal();
+	RecordVal *resp_endp_val = conn_val->Lookup(resp_endp_idx)->AsRecordVal();
+
+	orig_endp_val->Assign(0, new Val(orig->Size(), TYPE_COUNT));
+	orig_endp_val->Assign(1, new Val(int(orig->state), TYPE_COUNT));
+	resp_endp_val->Assign(0, new Val(resp->Size(), TYPE_COUNT));
+	resp_endp_val->Assign(1, new Val(int(resp->state), TYPE_COUNT));
+
+	// Call children's UpdateConnVal
+	Analyzer::UpdateConnVal(conn_val);
+
+	// Have to do packet_children ourselves.
+	LOOP_OVER_GIVEN_CHILDREN(i, packet_children)
+		(*i)->UpdateConnVal(conn_val);
 	}
 
 Val* TCP_Analyzer::BuildSYNPacketVal(int is_orig, const IP_Hdr* ip,
diff --git a/src/TCP.h b/src/TCP.h
index 1acc605dfc..1db8c1ed68 100644
--- a/src/TCP.h
+++ b/src/TCP.h
@@ -77,6 +77,9 @@ public:
 			const u_char* option, TCP_Analyzer* analyzer,
 			bool is_orig, void* cookie);
 
+	// From Analyzer.h
+	virtual void UpdateConnVal(RecordVal *conn_val);
+
 	// Needs to be static because it's passed as a pointer-to-function
 	// rather than pointer-to-member-function.
 	static int ParseTCPOptions(const struct tcphdr* tcp,
@@ -100,7 +103,6 @@ protected:
 	virtual void DeliverStream(int len, const u_char* data, bool orig);
 	virtual void Undelivered(int seq, int len, bool orig);
 	virtual void FlipRoles();
-	virtual void UpdateEndpointVal(RecordVal* endp, int is_orig);
 	virtual bool IsReuse(double t, const u_char* pkt);
 
 	// Returns the TCP header pointed to by data (which we assume is
diff --git a/src/Type.cc b/src/Type.cc
index 458a672d41..6e87a1f83a 100644
--- a/src/Type.cc
+++ b/src/Type.cc
@@ -848,8 +848,8 @@ void TypeDecl::DescribeReST(ODesc* d) const
 	}
 
 CommentedTypeDecl::CommentedTypeDecl(BroType* t, const char* i,
-			attr_list* attrs, std::list<std::string>* cmnt_list)
-	: TypeDecl(t, i, attrs)
+			attr_list* attrs, bool in_record, std::list<std::string>* cmnt_list)
+	: TypeDecl(t, i, attrs, in_record)
 	{
 	comments = cmnt_list;
 	}
@@ -1157,6 +1157,7 @@ void RecordType::DescribeFieldsReST(ODesc* d, bool func_args) const
 	for ( int i = 0; i < num_fields; ++i )
 		{
 		if ( i > 0 )
+			{
 			if ( func_args )
 				d->Add(", ");
 			else
@@ -1164,6 +1165,7 @@ void RecordType::DescribeFieldsReST(ODesc* d, bool func_args) const
 				d->NL();
 				d->NL();
 				}
+			}
 
 		FieldDecl(i)->DescribeReST(d);
 		}
diff --git a/src/Type.h b/src/Type.h
index 403ccffa89..b8cb7e2aa5 100644
--- a/src/Type.h
+++ b/src/Type.h
@@ -420,7 +420,7 @@ public:
 class CommentedTypeDecl : public TypeDecl {
 public:
 	CommentedTypeDecl(BroType* t, const char* i, attr_list* attrs = 0,
-			std::list<std::string>* cmnt_list = 0);
+			bool in_record = false, std::list<std::string>* cmnt_list = 0);
 	virtual ~CommentedTypeDecl();
 
 	void DescribeReST(ODesc* d) const;
@@ -456,6 +456,8 @@ public:
 	// Given an offset, returns the field's name.
 	const char* FieldName(int field) const;
 
+	type_decl_list* Types() { return types; }
+
 	// Given an offset, returns the field's TypeDecl.
 	const TypeDecl* FieldDecl(int field) const;
 	TypeDecl* FieldDecl(int field);
diff --git a/src/UDP.cc b/src/UDP.cc
index 78020bbbc8..21d5b96945 100644
--- a/src/UDP.cc
+++ b/src/UDP.cc
@@ -162,6 +162,22 @@ void UDP_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig,
 		ForwardPacket(len, data, is_orig, seq, ip, caplen);
 	}
 
+void UDP_Analyzer::UpdateConnVal(RecordVal *conn_val)
+	{
+	int orig_endp_idx = connection_type->FieldOffset("orig");
+	int resp_endp_idx = connection_type->FieldOffset("resp");
+	RecordVal *orig_endp = conn_val->Lookup(orig_endp_idx)->AsRecordVal();
+	RecordVal *resp_endp = conn_val->Lookup(resp_endp_idx)->AsRecordVal();
+
+	orig_endp = conn_val->Lookup(orig_endp_idx)->AsRecordVal();
+	resp_endp = conn_val->Lookup(resp_endp_idx)->AsRecordVal();
+	UpdateEndpointVal(orig_endp, 1);
+	UpdateEndpointVal(resp_endp, 0);
+
+	// Call children's UpdateConnVal
+	Analyzer::UpdateConnVal(conn_val);
+	}
+
 void UDP_Analyzer::UpdateEndpointVal(RecordVal* endp, int is_orig)
 	{
 	bro_int_t size = is_orig ? request_len : reply_len;
diff --git a/src/UDP.h b/src/UDP.h
index 7fe50492b4..b04c5e3ef0 100644
--- a/src/UDP.h
+++ b/src/UDP.h
@@ -19,6 +19,8 @@ public:
 
 	virtual void Init();
 
+	virtual void UpdateConnVal(RecordVal *conn_val);
+
 	static Analyzer* InstantiateAnalyzer(Connection* conn)
 		{ return new UDP_Analyzer(conn); }
 
@@ -28,12 +30,14 @@ protected:
 	virtual void Done();
 	virtual void DeliverPacket(int len, const u_char* data, bool orig,
 					int seq, const IP_Hdr* ip, int caplen);
-	virtual void UpdateEndpointVal(RecordVal* endp, int is_orig);
 	virtual bool IsReuse(double t, const u_char* pkt);
 	virtual unsigned int MemoryAllocation() const;
 
 	bro_int_t request_len, reply_len;
 
+private:
+	void UpdateEndpointVal(RecordVal* endp, int is_orig);
+
 #define HIST_ORIG_DATA_PKT 0x1
 #define HIST_RESP_DATA_PKT 0x2
 #define HIST_ORIG_CORRUPT_PKT 0x4
diff --git a/src/Val.cc b/src/Val.cc
index a313e810cc..e0ba8df9bf 100644
--- a/src/Val.cc
+++ b/src/Val.cc
@@ -2866,7 +2866,7 @@ RecordVal::RecordVal(RecordType* t) : MutableVal(t)
 			else if ( tag == TYPE_TABLE )
 				def = new TableVal(type->AsTableType(), a);
 
-			else if ( t->Tag() == TYPE_VECTOR )
+			else if ( tag == TYPE_VECTOR )
 				def = new VectorVal(type->AsVectorType());
 			}
 
@@ -2883,7 +2883,7 @@ RecordVal::~RecordVal()
 
 void RecordVal::Assign(int field, Val* new_val, Opcode op)
 	{
-	if ( Lookup(field) &&
+	if ( new_val && Lookup(field) &&
 	     record_type->FieldType(field)->Tag() == TYPE_TABLE &&
 	     new_val->AsTableVal()->FindAttr(ATTR_MERGEABLE) )
 		{
@@ -2976,6 +2976,7 @@ RecordVal* RecordVal::CoerceTo(const RecordType* t, Val* aggr) const
 			Expr* rhs = new ConstExpr(Lookup(i)->Ref());
 			Expr* e = new RecordCoerceExpr(rhs, ar_t->FieldType(t_i)->AsRecordType());
 			ar->Assign(t_i, e->Eval(0));
+			continue;
 			}
 
 		ar->Assign(t_i, Lookup(i)->Ref());
@@ -3230,15 +3231,6 @@ bool VectorVal::Assign(unsigned int index, Val* element, const Expr* assigner,
 		return false;
 		}
 
-	if ( index == 0 || index > (1 << 30) )
-		{
-		if ( assigner )
-			assigner->Error(fmt("index (%d) must be positive",
-						index));
-		Unref(element);
-		return true;	// true = "no fatal error"
-		}
-
 	BroType* yt = Type()->AsVectorType()->YieldType();
 
 	if ( yt && yt->Tag() == TYPE_TABLE &&
@@ -3253,7 +3245,7 @@ bool VectorVal::Assign(unsigned int index, Val* element, const Expr* assigner,
 				Val* ival = new Val(index, TYPE_COUNT);
 				StateAccess::Log(new StateAccess(OP_ASSIGN_IDX,
 						this, ival, element,
-						(*val.vector_val)[index - 1]));
+						(*val.vector_val)[index]));
 				Unref(ival);
 				}
 
@@ -3263,10 +3255,10 @@ bool VectorVal::Assign(unsigned int index, Val* element, const Expr* assigner,
 			}
 		}
 
-	if ( index <= val.vector_val->size() )
-		Unref((*val.vector_val)[index - 1]);
+	if ( index < val.vector_val->size() )
+		Unref((*val.vector_val)[index]);
 	else
-		val.vector_val->resize(index);
+		val.vector_val->resize(index + 1);
 
 	if ( LoggingAccess() && op != OP_NONE )
 		{
@@ -3277,14 +3269,14 @@ bool VectorVal::Assign(unsigned int index, Val* element, const Expr* assigner,
 
 		StateAccess::Log(new StateAccess(op == OP_INCR ?
 				OP_INCR_IDX : OP_ASSIGN_IDX,
-				this, ival, element, (*val.vector_val)[index - 1]));
+				this, ival, element, (*val.vector_val)[index]));
 		Unref(ival);
 		}
 
 	// Note: we do *not* Ref() the element, if any, at this point.
 	// AssignExpr::Eval() already does this; other callers must remember
 	// to do it similarly.
-	(*val.vector_val)[index - 1] = element;
+	(*val.vector_val)[index] = element;
 
 	Modified();
 	return true;
@@ -3293,7 +3285,7 @@ bool VectorVal::Assign(unsigned int index, Val* element, const Expr* assigner,
 bool VectorVal::AssignRepeat(unsigned int index, unsigned int how_many,
 				Val* element, const Expr* assigner)
 	{
-	ResizeAtLeast(index + how_many - 1);
+	ResizeAtLeast(index + how_many);
 
 	for ( unsigned int i = index; i < index + how_many; ++i )
 		if ( ! Assign(i, element, assigner) )
@@ -3305,10 +3297,10 @@ bool VectorVal::AssignRepeat(unsigned int index, unsigned int how_many,
 
 Val* VectorVal::Lookup(unsigned int index) const
 	{
-	if ( index == 0 || index > val.vector_val->size() )
+	if ( index >= val.vector_val->size() )
 		return 0;
 
-	return (*val.vector_val)[index - 1];
+	return (*val.vector_val)[index];
 	}
 
 unsigned int VectorVal::Resize(unsigned int new_num_elements)
@@ -3397,7 +3389,7 @@ bool VectorVal::DoUnserialize(UnserialInfo* info)
 		{
 		Val* v;
 		UNSERIALIZE_OPTIONAL(v, Val::Unserialize(info, TYPE_ANY));
-		Assign(i + VECTOR_MIN, v, 0);
+		Assign(i, v, 0);
 		}
 
 	return true;
diff --git a/src/Val.h b/src/Val.h
index 2dede2364e..76edea5429 100644
--- a/src/Val.h
+++ b/src/Val.h
@@ -969,9 +969,6 @@ protected:
 };
 
 
-// The minimum index for vectors (0 or 1).
-const int VECTOR_MIN = 1;
-
 class VectorVal : public MutableVal {
 public:
 	VectorVal(VectorType* t);
diff --git a/src/Var.cc b/src/Var.cc
index 1211a5315b..00ac734c0a 100644
--- a/src/Var.cc
+++ b/src/Var.cc
@@ -242,22 +242,43 @@ void add_type(ID* id, BroType* t, attr_list* attr, int /* is_event */)
 	// t->GetTypeID() is true.
 	if ( generate_documentation )
 		{
-		SerializationFormat* form = new BinarySerializationFormat();
-		form->StartWrite();
-		CloneSerializer ss(form);
-		SerialInfo sinfo(&ss);
-		sinfo.cache = false;
+		switch ( t->Tag() ) {
+		// Only "shallow" copy types that may contain records because
+		// we want to be able to see additions to the original record type's
+		// list of fields
+		case TYPE_RECORD:
+			tnew = new RecordType(t->AsRecordType()->Types());
+			break;
+		case TYPE_TABLE:
+			tnew = new TableType(t->AsTableType()->Indices(),
+			                     t->AsTableType()->YieldType());
+			break;
+		case TYPE_VECTOR:
+			tnew = new VectorType(t->AsVectorType()->YieldType());
+			break;
+		case TYPE_FUNC:
+			tnew = new FuncType(t->AsFuncType()->Args(),
+			                    t->AsFuncType()->YieldType(),
+			                    t->AsFuncType()->IsEvent());
+			break;
+		default:
+			SerializationFormat* form = new BinarySerializationFormat();
+			form->StartWrite();
+			CloneSerializer ss(form);
+			SerialInfo sinfo(&ss);
+			sinfo.cache = false;
 
-		t->Serialize(&sinfo);
-		char* data;
-		uint32 len = form->EndWrite(&data);
-		form->StartRead(data, len);
+			t->Serialize(&sinfo);
+			char* data;
+			uint32 len = form->EndWrite(&data);
+			form->StartRead(data, len);
 
-		UnserialInfo uinfo(&ss);
-		uinfo.cache = false;
-		tnew = t->Unserialize(&uinfo);
+			UnserialInfo uinfo(&ss);
+			uinfo.cache = false;
+			tnew = t->Unserialize(&uinfo);
 
-		delete [] data;
+			delete [] data;
+		}
 
 		tnew->SetTypeID(copy_string(id->Name()));
 		}
diff --git a/src/bro.bif b/src/bro.bif
index dc3d90092d..447a739ffd 100644
--- a/src/bro.bif
+++ b/src/bro.bif
@@ -1979,9 +1979,14 @@ function precompile_pcap_filter%(id: PcapFilterID, s: string%): bool
 # Install precompiled pcap filter.
 function install_pcap_filter%(id: PcapFilterID%): bool
 	%{
-	// Don't allow the script-level to change the filter when
-	// the user has specified one on the command line.
-	if ( user_pcap_filter )
+	ID* user_filter = global_scope()->Lookup("cmd_line_bpf_filter");
+
+	if ( ! user_filter )
+		internal_error("global cmd_line_bpf_filter not defined");
+
+	if ( user_filter->ID_Val()->AsStringVal()->Len() )
+		// Don't allow the script-level to change the filter when
+		// the user has specified one on the command line.
 		return new Val(0, TYPE_BOOL);
 
 	bool success = true;
@@ -2390,7 +2395,7 @@ function any_set%(v: any%) : bool
 		}
 
 	VectorVal* vv = v->AsVectorVal();
-	for ( unsigned int i = VECTOR_MIN; i < vv->Size() + VECTOR_MIN; ++i )
+	for ( unsigned int i = 0; i < vv->Size(); ++i )
 		if ( vv->Lookup(i) && vv->Lookup(i)->AsBool() )
 			return new Val(true, TYPE_BOOL);
 
@@ -2408,7 +2413,7 @@ function all_set%(v: any%) : bool
 		}
 
 	VectorVal* vv = v->AsVectorVal();
-	for ( unsigned int i = VECTOR_MIN; i < vv->Size() + VECTOR_MIN; ++i )
+	for ( unsigned int i = 0; i < vv->Size(); ++i )
 		if ( ! vv->Lookup(i) || ! vv->Lookup(i)->AsBool() )
 			return new Val(false, TYPE_BOOL);
 
@@ -2591,8 +2596,8 @@ function order%(v: any, ...%) : index_vec
 	// adjusting indices as we do so.
 	for ( i = 0; i < n; ++i )
 		{
-		int ind = ind_vv[i] + VECTOR_MIN;
-		result_v->Assign(i + VECTOR_MIN, new Val(ind, TYPE_COUNT), 0);
+		int ind = ind_vv[i];
+		result_v->Assign(i, new Val(ind, TYPE_COUNT), 0);
 		}
 
 	return result_v;
@@ -3101,7 +3106,13 @@ function lookup_location%(a: addr%) : geo_location
 		}
 
 #else
-	builtin_run_time("Bro was not configured for GeoIP support");
+	static int missing_geoip_reported = 0;
+
+	if ( ! missing_geoip_reported )
+		{
+		builtin_run_time("Bro was not configured for GeoIP support");
+		missing_geoip_reported = 1;
+		}
 #endif
 
 	// We can get here even if we have GeoIP support if we weren't
@@ -3159,7 +3170,13 @@ function lookup_asn%(a: addr%) : count
 		return new Val(atoi(gir+2), TYPE_COUNT);
 		}
 #else
-	builtin_run_time("Bro was not configured for GeoIP ASN support");
+	static int missing_geoip_reported = 0;
+
+	if ( ! missing_geoip_reported )
+		{
+		builtin_run_time("Bro was not configured for GeoIP ASN support");
+		missing_geoip_reported = 1;
+		}
 #endif
 
 	// We can get here even if we have GeoIP support, if we weren't
@@ -3323,6 +3340,15 @@ function entropy_test_finish%(index: any%): entropy_test_result
 	return ent_result;
 	%}
 
+function bro_has_ipv6%(%) : bool
+    %{
+#ifdef BROv6
+	return new Val(1, TYPE_BOOL);
+#else
+	return new Val(0, TYPE_BOOL);
+#endif
+    %}
+
 
 %%{
 #include <openssl/x509.h>
diff --git a/src/builtin-func.y b/src/builtin-func.y
index a35d0d9612..4f97135ab5 100644
--- a/src/builtin-func.y
+++ b/src/builtin-func.y
@@ -319,8 +319,8 @@ definitions:	definitions definition opt_ws
 			fprintf(fp_netvar_h, "// %s\n\n", auto_gen_comment);
 			fprintf(fp_netvar_init, "// %s\n\n", auto_gen_comment);
 
+			fprintf(fp_bro_init, "%s", $1);
 			fprintf(fp_bro_init, "export {\n");
-			fprintf(fp_func_def, "%s", $1);
 			}
 	;
 
diff --git a/src/const.bif b/src/const.bif
index 4c11d7d47c..e51028c742 100644
--- a/src/const.bif
+++ b/src/const.bif
@@ -5,3 +5,5 @@
 const ignore_keep_alive_rexmit: bool;
 const skip_http_data: bool;
 const parse_udp_tunnels: bool;
+const use_conn_size_analyzer: bool;
+
diff --git a/src/event.bif b/src/event.bif
index 5d3be37d0d..d42d0b58f1 100644
--- a/src/event.bif
+++ b/src/event.bif
@@ -52,6 +52,7 @@ event icmp_echo_request%(c: connection, icmp: icmp_conn, id: count, seq: count,
 event icmp_echo_reply%(c: connection, icmp: icmp_conn, id: count, seq: count, payload: string%);
 event icmp_unreachable%(c: connection, icmp: icmp_conn, code: count, context: icmp_context%);
 event icmp_time_exceeded%(c: connection, icmp: icmp_conn, code: count, context: icmp_context%);
+event icmp_redirect%(c: connection, icmp: icmp_conn, a: addr%);
 event net_stats_update%(t: time, ns: net_stats%);
 event conn_stats%(c: connection, os: endpoint_stats, rs: endpoint_stats%);
 event conn_weird%(name: string, c: connection%);
diff --git a/src/main.cc b/src/main.cc
index a5c33040db..70a1d8e4e9 100644
--- a/src/main.cc
+++ b/src/main.cc
@@ -9,6 +9,7 @@
 #include <unistd.h>
 #include <signal.h>
 #include <string.h>
+#include <list>
 #ifdef HAVE_GETOPT_H
 #include <getopt.h>
 #endif
@@ -47,6 +48,7 @@ extern "C" void OPENSSL_add_all_algorithms_conf(void);
 #include "Stats.h"
 #include "ConnCompressor.h"
 #include "DPM.h"
+#include "BroDoc.h"
 
 #include "binpac_bro.h"
 
@@ -103,6 +105,8 @@ char* proc_status_file = 0;
 
 int FLAGS_use_binpac = false;
 
+extern std::list<BroDoc*> docs_generated;
+
 // Keep copy of command line
 int bro_argc;
 char** bro_argv;
@@ -349,6 +353,7 @@ int main(int argc, char** argv)
 	char* events_file = 0;
 	char* seed_load_file = getenv("BRO_SEED_FILE");
 	char* seed_save_file = 0;
+	char* user_pcap_filter = 0;
 	int seed = 0;
 	int dump_cfg = false;
 	int to_xml = 0;
@@ -743,6 +748,16 @@ int main(int argc, char** argv)
 
 	init_general_global_var();
 
+	if ( user_pcap_filter )
+		{
+		ID* id = global_scope()->Lookup("cmd_line_bpf_filter");
+
+		if ( ! id )
+			internal_error("global cmd_line_bpf_filter not defined");
+
+		id->SetVal(new StringVal(user_pcap_filter));
+		}
+
 	// Parse rule files defined on the script level.
 	char* script_rule_files =
 		copy_string(internal_val("signature_files")->AsString()->CheckString());
@@ -800,8 +815,7 @@ int main(int argc, char** argv)
 
 	if ( dns_type != DNS_PRIME )
 		net_init(interfaces, read_files, netflows, flow_files,
-			writefile,
-			user_pcap_filter ? user_pcap_filter : "tcp or udp",
+			writefile, "tcp or udp or icmp",
 			secondary_path->Filter(), do_watchdog);
 
 	if ( ! reading_traces )
@@ -961,6 +975,20 @@ int main(int argc, char** argv)
 
 	mgr.Drain();
 
+	if ( generate_documentation )
+		{
+		std::list<BroDoc*>::iterator it;
+
+		for ( it = docs_generated.begin(); it != docs_generated.end(); ++it )
+			(*it)->WriteDocFile();
+
+		for ( it = docs_generated.begin(); it != docs_generated.end(); ++it )
+			delete *it;
+
+		terminate_bro();
+		return 0;
+		}
+
 	have_pending_timers = ! reading_traces && timer_mgr->Size() > 0;
 
 	if ( io_sources.Size() > 0 || have_pending_timers )
diff --git a/src/parse.y b/src/parse.y
index 8e8a75cad7..8b3f8d64c8 100644
--- a/src/parse.y
+++ b/src/parse.y
@@ -936,6 +936,7 @@ type_decl:
 
 			if ( generate_documentation )
 				{
+				// TypeDecl ctor deletes the attr list, so make a copy
 				attr_list* a = $5;
 				attr_list* a_copy = 0;
 
@@ -947,7 +948,7 @@ type_decl:
 					}
 
 				last_fake_type_decl = new CommentedTypeDecl(
-					$4, $2, a_copy, concat_opt_docs($1, $7));
+					$4, $2, a_copy, (in_record > 0), concat_opt_docs($1, $7));
 				}
 
 			$$ = new TypeDecl($4, $2, $5, (in_record > 0));
@@ -1067,8 +1068,10 @@ decl:
 			}
 
 	|	TOK_REDEF TOK_RECORD global_id TOK_ADD_TO
-			'{' type_decl_list '}' opt_attr ';'
+			'{' { do_doc_token_start(); } type_decl_list '}' opt_attr ';'
 			{
+			do_doc_token_stop();
+
 			if ( ! $3->Type() )
 				$3->Error("unknown identifier");
 			else
@@ -1078,9 +1081,29 @@ decl:
 					$3->Error("not a record type");
 				else
 					{
-					const char* error = add_to->AddFields($6, $8);
+					const char* error = add_to->AddFields($7, $9);
 					if ( error )
-					$3->Error(error);
+						$3->Error(error);
+					else if ( generate_documentation )
+						{
+						if ( fake_type_decl_list )
+							{
+							BroType* fake_record =
+								new RecordType(fake_type_decl_list);
+							ID* fake = create_dummy_id($3, fake_record);
+							fake_type_decl_list = 0;
+							BroDocObj* o =
+								new BroDocObj(fake, reST_doc_comments, true);
+							o->SetRole(true);
+							current_reST_doc->AddRedef(o);
+							}
+						else
+							{
+							fprintf(stderr, "Warning: doc mode did not process "
+								"record extension for '%s', CommentedTypeDecl"
+								"list unavailable.\n", $3->Name());
+							}
+						}
 					}
 				}
 			}
@@ -1622,7 +1645,7 @@ opt_doc_list:
 
 int yyerror(const char msg[])
 	{
-	char* msgbuf = new char[strlen(msg) + strlen(last_tok) + 64];
+	char* msgbuf = new char[strlen(msg) + strlen(last_tok) + 128];
 
 	if ( last_tok[0] == '\n' )
 		sprintf(msgbuf, "%s, on previous line", msg);
@@ -1631,6 +1654,10 @@ int yyerror(const char msg[])
 	else
 		sprintf(msgbuf, "%s, at or near \"%s\"", msg, last_tok);
 
+	if ( generate_documentation )
+		strcat(msgbuf, "\nDocumentation mode is enabled: "
+		       "remember to check syntax of ## style comments\n");
+
 	error(msgbuf);
 
 	return 0;
diff --git a/src/scan.l b/src/scan.l
index b56583ab44..ee57369b58 100644
--- a/src/scan.l
+++ b/src/scan.l
@@ -16,7 +16,6 @@
 #include "PolicyFile.h"
 #include "broparse.h"
 #include "BroDoc.h"
-#include "BroBifDoc.h"
 #include "Analyzer.h"
 #include "AnalyzerTags.h"
 
@@ -58,7 +57,7 @@ char last_tok[128];
 static PList(char) files_scanned;
 
 // reST documents that we've created (or have at least opened so far).
-static std::list<BroDoc*> docs_generated;
+std::list<BroDoc*> docs_generated;
 
 // reST comments (those starting with ##) seen so far.
 std::list<std::string>* reST_doc_comments = 0;
@@ -611,17 +610,8 @@ static int load_files_with_prefix(const char* orig_file)
 
 			if ( generate_documentation )
 				{
-				const char* bifExtStart = strstr(full_filename, ".bif.bro");
-				BroDoc* reST_doc;
-
-				if ( bifExtStart )
-					reST_doc = new BroBifDoc(full_filename);
-				else
-					reST_doc = new BroDoc(full_filename);
-
-				docs_generated.push_back(reST_doc);
-
-				current_reST_doc = reST_doc;
+				current_reST_doc = new BroDoc(full_filename);
+				docs_generated.push_back(current_reST_doc);
 				}
 			}
 
@@ -877,18 +867,7 @@ int yywrap()
 		}
 
 	if ( generate_documentation )
-		{
-		std::list<BroDoc*>::iterator it;
-
-		for ( it = docs_generated.begin(); it != docs_generated.end(); ++it )
-			{
-			(*it)->WriteDocFile();
-			delete *it;
-			}
-
-		docs_generated.clear();
 		clear_reST_doc_comments();
-		}
 
 	// Otherwise, we are done.
 	return 1;
diff --git a/src/strings.bif b/src/strings.bif
index 191d059b84..f10dc412f3 100644
--- a/src/strings.bif
+++ b/src/strings.bif
@@ -244,8 +244,11 @@ Val* do_split(StringVal* str_val, RE_Matcher* re, TableVal* other_sep,
 			--n;
 			}
 
-		if ( num_sep >= max_num_sep )
+		if ( max_num_sep && num_sep >= max_num_sep )
+			{
 			offset = end_of_s - s;
+			n=0;
+			}
 
 		Val* ind = new Val(++num, TYPE_COUNT);
 		a->Assign(ind, new StringVal(offset, (const char*) s));
@@ -627,7 +630,7 @@ function strip%(str: string%): string
 function string_fill%(len: int, source: string%): string
 	%{
 	const u_char* src = source->Bytes();
-	int n = source->Len();
+	int64_t n = source->Len();
 	char* dst = new char[len];
 
 	for ( int i = 0; i < len; i += n )
diff --git a/src/util.cc b/src/util.cc
index cd28a94b54..5684fe20c1 100644
--- a/src/util.cc
+++ b/src/util.cc
@@ -295,9 +295,9 @@ char* strcasestr(const char* s, const char* find)
 	}
 #endif
 
-int atoi_n(int len, const char* s, const char** end, int base, int& result)
+template<class T> int atoi_n(int len, const char* s, const char** end, int base, T& result)
 	{
-	int n = 0;
+	T n = 0;
 	int neg = 0;
 
 	if ( len > 0 && *s == '-' )
@@ -340,6 +340,32 @@ int atoi_n(int len, const char* s, const char** end, int base, int& result)
 	return 1;
 	}
 
+// Instantiate the ones we need.
+template int atoi_n<int>(int len, const char* s, const char** end, int base, int& result);
+template int atoi_n<int64_t>(int len, const char* s, const char** end, int base, int64_t& result);
+
+char* uitoa_n(uint64 value, char* str, int n, int base)
+	{
+	static char dig[] = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
+
+	int i = 0;
+	uint64 v;
+	char* p, *q;
+	char c;
+
+	v = value;
+
+	do {
+		str[i++] = dig[v % base];
+		v /= base;
+	} while ( v && i < n - 1 );
+
+	str[i] = '\0';
+
+	return str;
+	}
+
+
 int strstr_n(const int big_len, const u_char* big,
 		const int little_len, const u_char* little)
 	{
@@ -661,6 +687,11 @@ void init_random_seed(uint32 seed, const char* read_file, const char* write_file
 				write_file);
 	}
 
+bool have_random_seed()
+	{
+	return bro_rand_determistic;
+	}
+
 long int bro_random()
 	{
 	if ( ! bro_rand_determistic )
diff --git a/src/util.h b/src/util.h
index 276b6f320c..82bc0adaf3 100644
--- a/src/util.h
+++ b/src/util.h
@@ -110,8 +110,8 @@ extern int strcasecmp_n(int s_len, const char* s, const char* t);
 extern char* strcasestr(const char* s, const char* find);
 #endif
 extern const char* strpbrk_n(size_t len, const char* s, const char* charset);
-extern int atoi_n(int len, const char* s, const char** end,
-			int base, int& result);
+template<class T> int atoi_n(int len, const char* s, const char** end, int base, T& result);
+extern char* uitoa_n(uint64 value, char* str, int n, int base);
 int strstr_n(const int big_len, const unsigned char* big,
 		const int little_len, const unsigned char* little);
 extern int fputs(int len, const char* s, FILE* fp);
@@ -149,6 +149,9 @@ extern const char* md5_digest_print(const unsigned char digest[16]);
 extern void init_random_seed(uint32 seed, const char* load_file,
 				const char* write_file);
 
+// Returns true if the user explicitly set a seed via init_random_seed();
+extern bool have_random_seed();
+
 // Replacement for the system random(), to which is normally falls back
 // except when a seed has been given. In that case, we use our own
 // predictable PRNG.
@@ -156,9 +159,6 @@ long int bro_random();
 
 extern uint64 rand64bit();
 
-#define UHASH_KEY_SIZE	32
-extern uint8 uhash_key[UHASH_KEY_SIZE];
-
 // Each event source that may generate events gets an internally unique ID.
 // This is always LOCAL for a local Bro. For remote event sources, it gets
 // assigned by the RemoteSerializer.
@@ -233,16 +233,6 @@ extern struct timeval double_to_timeval(double t);
 // Return > 0 if tv_a > tv_b, 0 if equal, < 0 if tv_a < tv_b.
 extern int time_compare(struct timeval* tv_a, struct timeval* tv_b);
 
-inline int min(int a, int b)
-	{
-	return a < b ? a : b;
-	}
-
-inline int max(int a, int b)
-	{
-	return a > b ? a : b;
-	}
-
 // For now, don't use hash_maps - they're not fully portable.
 #if 0
 // Use for hash_map's string keys.
diff --git a/testing/btest/Baseline/analyzers.conn-size-cc/conn.log b/testing/btest/Baseline/analyzers.conn-size-cc/conn.log
new file mode 100644
index 0000000000..2f703cbcd6
--- /dev/null
+++ b/testing/btest/Baseline/analyzers.conn-size-cc/conn.log
@@ -0,0 +1,5 @@
+1128727430.350788 ? 141.42.64.125 125.190.109.199 other 56729 12345 tcp ? ? S0 X 1 60 0 0 cc=1
+1144876538.705610 5.921003 169.229.147.203 239.255.255.253 other 49370 427 udp 147 ? S0 X 3 231 0 0
+1144876599.397603 0.815763 192.150.186.169 194.64.249.244 http 53063 80 tcp 377 445 SF X 6 677 5 713
+1144876709.032670 9.000191 169.229.147.43 239.255.255.253 other 49370 427 udp 196 ? S0 X 4 308 0 0
+1144876697.068273 0.000650 192.150.186.169 192.150.186.15 icmp-unreach 3 3 icmp 56 ? OTH X 2 112 0 0
diff --git a/testing/btest/Baseline/analyzers.conn-size/conn.log b/testing/btest/Baseline/analyzers.conn-size/conn.log
new file mode 100644
index 0000000000..8129bc37f8
--- /dev/null
+++ b/testing/btest/Baseline/analyzers.conn-size/conn.log
@@ -0,0 +1,5 @@
+1128727430.350788 ? 141.42.64.125 125.190.109.199 other 56729 12345 tcp ? ? S0 X 1 60 0 0
+1144876538.705610 5.921003 169.229.147.203 239.255.255.253 other 49370 427 udp 147 ? S0 X 3 231 0 0
+1144876599.397603 0.815763 192.150.186.169 194.64.249.244 http 53063 80 tcp 377 445 SF X 6 697 5 713
+1144876709.032670 9.000191 169.229.147.43 239.255.255.253 other 49370 427 udp 196 ? S0 X 4 308 0 0
+1144876697.068273 0.000650 192.150.186.169 192.150.186.15 icmp-unreach 3 3 icmp 56 ? OTH X 2 112 0 0
diff --git a/testing/btest/Baseline/bifs.netbios-functions/out b/testing/btest/Baseline/bifs.netbios-functions/out
index dacf5b9ab5..d849dbff71 100644
--- a/testing/btest/Baseline/bifs.netbios-functions/out
+++ b/testing/btest/Baseline/bifs.netbios-functions/out
@@ -2,7 +2,7 @@ MARTIN
 3
 WORKGROUP
 27
-^A^B__MSBROWSE__^B
-1
 ISATAP
 0
+^A^B__MSBROWSE__^B
+1
diff --git a/testing/btest/Baseline/bifs.string_splitting/out b/testing/btest/Baseline/bifs.string_splitting/out
index 7e0c0dfcfa..8514916834 100644
--- a/testing/btest/Baseline/bifs.string_splitting/out
+++ b/testing/btest/Baseline/bifs.string_splitting/out
@@ -1,4 +1,13 @@
 {
-[1] = X-Mailer,
-[2] = Testing Test (http://www.example.com)
+[2] = Testing Test (http://www.example.com),
+[1] = X-Mailer
+}
+{
+[2] = =,
+[4] = =,
+[6] = =,
+[7] =  D,
+[1] = A ,
+[5] =  C ,
+[3] =  B 
 }
diff --git a/testing/btest/Baseline/core.conn-id/counts b/testing/btest/Baseline/core.conn-id/counts
new file mode 100644
index 0000000000..a8fa06e1be
--- /dev/null
+++ b/testing/btest/Baseline/core.conn-id/counts
@@ -0,0 +1 @@
+62
diff --git a/testing/btest/Baseline/core.conn-id/output b/testing/btest/Baseline/core.conn-id/output
new file mode 100644
index 0000000000..3f7256278e
--- /dev/null
+++ b/testing/btest/Baseline/core.conn-id/output
@@ -0,0 +1,78 @@
+[orig_h=141.142.220.202, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], UWkUyAuUGXf
+[orig_h=141.142.220.202, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], UWkUyAuUGXf
+[orig_h=141.142.220.50, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], 56gKBmhBBB6
+[orig_h=141.142.220.50, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], 56gKBmhBBB6
+[orig_h=141.142.220.118, orig_p=35634/tcp, resp_h=208.80.152.2, resp_p=80/tcp], 50da4BEzauh
+[orig_h=141.142.220.118, orig_p=35634/tcp, resp_h=208.80.152.2, resp_p=80/tcp], 50da4BEzauh
+[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], WUjEZFOdSS
+[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], WUjEZFOdSS
+[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], WUjEZFOdSS
+[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], WUjEZFOdSS
+[orig_h=141.142.220.118, orig_p=43927/udp, resp_h=141.142.2.2, resp_p=53/udp], ecqdozAET6c
+[orig_h=141.142.220.118, orig_p=43927/udp, resp_h=141.142.2.2, resp_p=53/udp], ecqdozAET6c
+[orig_h=141.142.220.118, orig_p=37676/udp, resp_h=141.142.2.2, resp_p=53/udp], tdkrEYpj5ja
+[orig_h=141.142.220.118, orig_p=37676/udp, resp_h=141.142.2.2, resp_p=53/udp], tdkrEYpj5ja
+[orig_h=141.142.220.118, orig_p=40526/udp, resp_h=141.142.2.2, resp_p=53/udp], F5XgctwO3Vl
+[orig_h=141.142.220.118, orig_p=40526/udp, resp_h=141.142.2.2, resp_p=53/udp], F5XgctwO3Vl
+[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], svqqNKN9CFj
+[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], svqqNKN9CFj
+[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], UZkBBvjF0r8
+[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], UZkBBvjF0r8
+[orig_h=141.142.220.118, orig_p=32902/udp, resp_h=141.142.2.2, resp_p=53/udp], nSEQzFk1LZc
+[orig_h=141.142.220.118, orig_p=32902/udp, resp_h=141.142.2.2, resp_p=53/udp], nSEQzFk1LZc
+[orig_h=141.142.220.118, orig_p=59816/udp, resp_h=141.142.2.2, resp_p=53/udp], rmXOq6wncn1
+[orig_h=141.142.220.118, orig_p=59816/udp, resp_h=141.142.2.2, resp_p=53/udp], rmXOq6wncn1
+[orig_h=141.142.220.118, orig_p=59714/udp, resp_h=141.142.2.2, resp_p=53/udp], 4YYJTjETe1i
+[orig_h=141.142.220.118, orig_p=59714/udp, resp_h=141.142.2.2, resp_p=53/udp], 4YYJTjETe1i
+[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OldlyspNIr7
+[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OldlyspNIr7
+[orig_h=141.142.220.118, orig_p=58206/udp, resp_h=141.142.2.2, resp_p=53/udp], R8BqVlcp23e
+[orig_h=141.142.220.118, orig_p=58206/udp, resp_h=141.142.2.2, resp_p=53/udp], R8BqVlcp23e
+[orig_h=141.142.220.118, orig_p=38911/udp, resp_h=141.142.2.2, resp_p=53/udp], duYdXg7bTa3
+[orig_h=141.142.220.118, orig_p=38911/udp, resp_h=141.142.2.2, resp_p=53/udp], duYdXg7bTa3
+[orig_h=141.142.220.118, orig_p=59746/udp, resp_h=141.142.2.2, resp_p=53/udp], yzqaQTU9DXe
+[orig_h=141.142.220.118, orig_p=59746/udp, resp_h=141.142.2.2, resp_p=53/udp], yzqaQTU9DXe
+[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OPM7xFSDNw3
+[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OPM7xFSDNw3
+[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], j5w2LueK8Ti
+[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], j5w2LueK8Ti
+[orig_h=141.142.220.118, orig_p=45000/udp, resp_h=141.142.2.2, resp_p=53/udp], N6rbUGwigQ7
+[orig_h=141.142.220.118, orig_p=45000/udp, resp_h=141.142.2.2, resp_p=53/udp], N6rbUGwigQ7
+[orig_h=141.142.220.118, orig_p=48479/udp, resp_h=141.142.2.2, resp_p=53/udp], 8b9q7qPtzhd
+[orig_h=141.142.220.118, orig_p=48479/udp, resp_h=141.142.2.2, resp_p=53/udp], 8b9q7qPtzhd
+[orig_h=141.142.220.118, orig_p=48128/udp, resp_h=141.142.2.2, resp_p=53/udp], KOdlL7sC9z2
+[orig_h=141.142.220.118, orig_p=48128/udp, resp_h=141.142.2.2, resp_p=53/udp], KOdlL7sC9z2
+[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], hvOo97vj60k
+[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], hvOo97vj60k
+[orig_h=141.142.220.118, orig_p=56056/udp, resp_h=141.142.2.2, resp_p=53/udp], FHu81uYujA9
+[orig_h=141.142.220.118, orig_p=56056/udp, resp_h=141.142.2.2, resp_p=53/udp], FHu81uYujA9
+[orig_h=141.142.220.118, orig_p=55092/udp, resp_h=141.142.2.2, resp_p=53/udp], 2M1wDTa0C7a
+[orig_h=141.142.220.118, orig_p=55092/udp, resp_h=141.142.2.2, resp_p=53/udp], 2M1wDTa0C7a
+[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], OKiJdtzKWPk
+[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], OKiJdtzKWPk
+[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], UZkBBvjF0r8
+[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], UZkBBvjF0r8
+[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], svqqNKN9CFj
+[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], svqqNKN9CFj
+[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OldlyspNIr7
+[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OldlyspNIr7
+[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], j5w2LueK8Ti
+[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], j5w2LueK8Ti
+[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OPM7xFSDNw3
+[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OPM7xFSDNw3
+[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], hvOo97vj60k
+[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], hvOo97vj60k
+[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], OKiJdtzKWPk
+[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], OKiJdtzKWPk
+[orig_h=141.142.220.235, orig_p=6705/tcp, resp_h=173.192.163.128, resp_p=80/tcp], tpUWfNdSLE
+[orig_h=141.142.220.235, orig_p=6705/tcp, resp_h=173.192.163.128, resp_p=80/tcp], tpUWfNdSLE
+[orig_h=141.142.220.44, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], ra1C6ZLut4b
+[orig_h=141.142.220.44, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], ra1C6ZLut4b
+[orig_h=141.142.220.226, orig_p=137/udp, resp_h=141.142.220.255, resp_p=137/udp], UElDH5b9qA5
+[orig_h=141.142.220.226, orig_p=137/udp, resp_h=141.142.220.255, resp_p=137/udp], UElDH5b9qA5
+[orig_h=141.142.220.226, orig_p=55131/udp, resp_h=224.0.0.252, resp_p=5355/udp], sO3mBXBav1h
+[orig_h=141.142.220.226, orig_p=55131/udp, resp_h=224.0.0.252, resp_p=5355/udp], sO3mBXBav1h
+[orig_h=141.142.220.226, orig_p=55671/udp, resp_h=224.0.0.252, resp_p=5355/udp], xAQqZE8Wdp4
+[orig_h=141.142.220.226, orig_p=55671/udp, resp_h=224.0.0.252, resp_p=5355/udp], xAQqZE8Wdp4
+[orig_h=141.142.220.238, orig_p=56641/udp, resp_h=141.142.220.255, resp_p=137/udp], zVecVnfOlsf
+[orig_h=141.142.220.238, orig_p=56641/udp, resp_h=141.142.220.255, resp_p=137/udp], zVecVnfOlsf
diff --git a/testing/btest/Baseline/core.conn-id/output.cc b/testing/btest/Baseline/core.conn-id/output.cc
new file mode 100644
index 0000000000..f03a74f541
--- /dev/null
+++ b/testing/btest/Baseline/core.conn-id/output.cc
@@ -0,0 +1,80 @@
+[orig_h=141.142.220.202, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], UWkUyAuUGXf
+[orig_h=141.142.220.202, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], UWkUyAuUGXf
+[orig_h=141.142.220.50, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], 56gKBmhBBB6
+[orig_h=141.142.220.50, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], 56gKBmhBBB6
+[orig_h=141.142.220.118, orig_p=35634/tcp, resp_h=208.80.152.2, resp_p=80/tcp], 50da4BEzauh
+[orig_h=141.142.220.118, orig_p=35634/tcp, resp_h=208.80.152.2, resp_p=80/tcp], 50da4BEzauh
+[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], WUjEZFOdSS
+[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], WUjEZFOdSS
+[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], WUjEZFOdSS
+[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], WUjEZFOdSS
+[orig_h=141.142.220.118, orig_p=43927/udp, resp_h=141.142.2.2, resp_p=53/udp], ecqdozAET6c
+[orig_h=141.142.220.118, orig_p=43927/udp, resp_h=141.142.2.2, resp_p=53/udp], ecqdozAET6c
+[orig_h=141.142.220.118, orig_p=37676/udp, resp_h=141.142.2.2, resp_p=53/udp], tdkrEYpj5ja
+[orig_h=141.142.220.118, orig_p=37676/udp, resp_h=141.142.2.2, resp_p=53/udp], tdkrEYpj5ja
+[orig_h=141.142.220.118, orig_p=40526/udp, resp_h=141.142.2.2, resp_p=53/udp], F5XgctwO3Vl
+[orig_h=141.142.220.118, orig_p=40526/udp, resp_h=141.142.2.2, resp_p=53/udp], F5XgctwO3Vl
+[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], svqqNKN9CFj
+[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], svqqNKN9CFj
+[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], UZkBBvjF0r8
+[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], UZkBBvjF0r8
+[orig_h=141.142.220.118, orig_p=32902/udp, resp_h=141.142.2.2, resp_p=53/udp], nSEQzFk1LZc
+[orig_h=141.142.220.118, orig_p=32902/udp, resp_h=141.142.2.2, resp_p=53/udp], nSEQzFk1LZc
+[orig_h=141.142.220.118, orig_p=59816/udp, resp_h=141.142.2.2, resp_p=53/udp], rmXOq6wncn1
+[orig_h=141.142.220.118, orig_p=59816/udp, resp_h=141.142.2.2, resp_p=53/udp], rmXOq6wncn1
+[orig_h=141.142.220.118, orig_p=59714/udp, resp_h=141.142.2.2, resp_p=53/udp], 4YYJTjETe1i
+[orig_h=141.142.220.118, orig_p=59714/udp, resp_h=141.142.2.2, resp_p=53/udp], 4YYJTjETe1i
+[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OldlyspNIr7
+[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OldlyspNIr7
+[orig_h=141.142.220.118, orig_p=58206/udp, resp_h=141.142.2.2, resp_p=53/udp], R8BqVlcp23e
+[orig_h=141.142.220.118, orig_p=58206/udp, resp_h=141.142.2.2, resp_p=53/udp], R8BqVlcp23e
+[orig_h=141.142.220.118, orig_p=38911/udp, resp_h=141.142.2.2, resp_p=53/udp], duYdXg7bTa3
+[orig_h=141.142.220.118, orig_p=38911/udp, resp_h=141.142.2.2, resp_p=53/udp], duYdXg7bTa3
+[orig_h=141.142.220.118, orig_p=59746/udp, resp_h=141.142.2.2, resp_p=53/udp], yzqaQTU9DXe
+[orig_h=141.142.220.118, orig_p=59746/udp, resp_h=141.142.2.2, resp_p=53/udp], yzqaQTU9DXe
+[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OPM7xFSDNw3
+[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OPM7xFSDNw3
+[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], j5w2LueK8Ti
+[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], j5w2LueK8Ti
+[orig_h=141.142.220.118, orig_p=45000/udp, resp_h=141.142.2.2, resp_p=53/udp], N6rbUGwigQ7
+[orig_h=141.142.220.118, orig_p=45000/udp, resp_h=141.142.2.2, resp_p=53/udp], N6rbUGwigQ7
+[orig_h=141.142.220.118, orig_p=48479/udp, resp_h=141.142.2.2, resp_p=53/udp], 8b9q7qPtzhd
+[orig_h=141.142.220.118, orig_p=48479/udp, resp_h=141.142.2.2, resp_p=53/udp], 8b9q7qPtzhd
+[orig_h=141.142.220.118, orig_p=48128/udp, resp_h=141.142.2.2, resp_p=53/udp], KOdlL7sC9z2
+[orig_h=141.142.220.118, orig_p=48128/udp, resp_h=141.142.2.2, resp_p=53/udp], KOdlL7sC9z2
+[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], hvOo97vj60k
+[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], hvOo97vj60k
+[orig_h=141.142.220.118, orig_p=56056/udp, resp_h=141.142.2.2, resp_p=53/udp], FHu81uYujA9
+[orig_h=141.142.220.118, orig_p=56056/udp, resp_h=141.142.2.2, resp_p=53/udp], FHu81uYujA9
+[orig_h=141.142.220.118, orig_p=55092/udp, resp_h=141.142.2.2, resp_p=53/udp], 2M1wDTa0C7a
+[orig_h=141.142.220.118, orig_p=55092/udp, resp_h=141.142.2.2, resp_p=53/udp], 2M1wDTa0C7a
+[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], OKiJdtzKWPk
+[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], OKiJdtzKWPk
+[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], UZkBBvjF0r8
+[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], UZkBBvjF0r8
+[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], svqqNKN9CFj
+[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], svqqNKN9CFj
+[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OldlyspNIr7
+[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OldlyspNIr7
+[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], j5w2LueK8Ti
+[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], j5w2LueK8Ti
+[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OPM7xFSDNw3
+[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OPM7xFSDNw3
+[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], hvOo97vj60k
+[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], hvOo97vj60k
+[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], OKiJdtzKWPk
+[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], OKiJdtzKWPk
+[orig_h=141.142.220.235, orig_p=6705/tcp, resp_h=173.192.163.128, resp_p=80/tcp], tpUWfNdSLE
+[orig_h=141.142.220.235, orig_p=6705/tcp, resp_h=173.192.163.128, resp_p=80/tcp], tpUWfNdSLE
+[orig_h=141.142.220.235, orig_p=6705/tcp, resp_h=173.192.163.128, resp_p=80/tcp], tpUWfNdSLE
+[orig_h=141.142.220.235, orig_p=6705/tcp, resp_h=173.192.163.128, resp_p=80/tcp], tpUWfNdSLE
+[orig_h=141.142.220.44, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], ra1C6ZLut4b
+[orig_h=141.142.220.44, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], ra1C6ZLut4b
+[orig_h=141.142.220.226, orig_p=137/udp, resp_h=141.142.220.255, resp_p=137/udp], UElDH5b9qA5
+[orig_h=141.142.220.226, orig_p=137/udp, resp_h=141.142.220.255, resp_p=137/udp], UElDH5b9qA5
+[orig_h=141.142.220.226, orig_p=55131/udp, resp_h=224.0.0.252, resp_p=5355/udp], sO3mBXBav1h
+[orig_h=141.142.220.226, orig_p=55131/udp, resp_h=224.0.0.252, resp_p=5355/udp], sO3mBXBav1h
+[orig_h=141.142.220.226, orig_p=55671/udp, resp_h=224.0.0.252, resp_p=5355/udp], xAQqZE8Wdp4
+[orig_h=141.142.220.226, orig_p=55671/udp, resp_h=224.0.0.252, resp_p=5355/udp], xAQqZE8Wdp4
+[orig_h=141.142.220.238, orig_p=56641/udp, resp_h=141.142.220.255, resp_p=137/udp], zVecVnfOlsf
+[orig_h=141.142.220.238, orig_p=56641/udp, resp_h=141.142.220.255, resp_p=137/udp], zVecVnfOlsf
diff --git a/testing/btest/Baseline/core.conn-id/output.cc2 b/testing/btest/Baseline/core.conn-id/output.cc2
new file mode 100644
index 0000000000..3f7256278e
--- /dev/null
+++ b/testing/btest/Baseline/core.conn-id/output.cc2
@@ -0,0 +1,78 @@
+[orig_h=141.142.220.202, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], UWkUyAuUGXf
+[orig_h=141.142.220.202, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], UWkUyAuUGXf
+[orig_h=141.142.220.50, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], 56gKBmhBBB6
+[orig_h=141.142.220.50, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], 56gKBmhBBB6
+[orig_h=141.142.220.118, orig_p=35634/tcp, resp_h=208.80.152.2, resp_p=80/tcp], 50da4BEzauh
+[orig_h=141.142.220.118, orig_p=35634/tcp, resp_h=208.80.152.2, resp_p=80/tcp], 50da4BEzauh
+[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], WUjEZFOdSS
+[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], WUjEZFOdSS
+[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], WUjEZFOdSS
+[orig_h=141.142.220.118, orig_p=48649/tcp, resp_h=208.80.152.118, resp_p=80/tcp], WUjEZFOdSS
+[orig_h=141.142.220.118, orig_p=43927/udp, resp_h=141.142.2.2, resp_p=53/udp], ecqdozAET6c
+[orig_h=141.142.220.118, orig_p=43927/udp, resp_h=141.142.2.2, resp_p=53/udp], ecqdozAET6c
+[orig_h=141.142.220.118, orig_p=37676/udp, resp_h=141.142.2.2, resp_p=53/udp], tdkrEYpj5ja
+[orig_h=141.142.220.118, orig_p=37676/udp, resp_h=141.142.2.2, resp_p=53/udp], tdkrEYpj5ja
+[orig_h=141.142.220.118, orig_p=40526/udp, resp_h=141.142.2.2, resp_p=53/udp], F5XgctwO3Vl
+[orig_h=141.142.220.118, orig_p=40526/udp, resp_h=141.142.2.2, resp_p=53/udp], F5XgctwO3Vl
+[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], svqqNKN9CFj
+[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], svqqNKN9CFj
+[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], UZkBBvjF0r8
+[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], UZkBBvjF0r8
+[orig_h=141.142.220.118, orig_p=32902/udp, resp_h=141.142.2.2, resp_p=53/udp], nSEQzFk1LZc
+[orig_h=141.142.220.118, orig_p=32902/udp, resp_h=141.142.2.2, resp_p=53/udp], nSEQzFk1LZc
+[orig_h=141.142.220.118, orig_p=59816/udp, resp_h=141.142.2.2, resp_p=53/udp], rmXOq6wncn1
+[orig_h=141.142.220.118, orig_p=59816/udp, resp_h=141.142.2.2, resp_p=53/udp], rmXOq6wncn1
+[orig_h=141.142.220.118, orig_p=59714/udp, resp_h=141.142.2.2, resp_p=53/udp], 4YYJTjETe1i
+[orig_h=141.142.220.118, orig_p=59714/udp, resp_h=141.142.2.2, resp_p=53/udp], 4YYJTjETe1i
+[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OldlyspNIr7
+[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OldlyspNIr7
+[orig_h=141.142.220.118, orig_p=58206/udp, resp_h=141.142.2.2, resp_p=53/udp], R8BqVlcp23e
+[orig_h=141.142.220.118, orig_p=58206/udp, resp_h=141.142.2.2, resp_p=53/udp], R8BqVlcp23e
+[orig_h=141.142.220.118, orig_p=38911/udp, resp_h=141.142.2.2, resp_p=53/udp], duYdXg7bTa3
+[orig_h=141.142.220.118, orig_p=38911/udp, resp_h=141.142.2.2, resp_p=53/udp], duYdXg7bTa3
+[orig_h=141.142.220.118, orig_p=59746/udp, resp_h=141.142.2.2, resp_p=53/udp], yzqaQTU9DXe
+[orig_h=141.142.220.118, orig_p=59746/udp, resp_h=141.142.2.2, resp_p=53/udp], yzqaQTU9DXe
+[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OPM7xFSDNw3
+[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OPM7xFSDNw3
+[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], j5w2LueK8Ti
+[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], j5w2LueK8Ti
+[orig_h=141.142.220.118, orig_p=45000/udp, resp_h=141.142.2.2, resp_p=53/udp], N6rbUGwigQ7
+[orig_h=141.142.220.118, orig_p=45000/udp, resp_h=141.142.2.2, resp_p=53/udp], N6rbUGwigQ7
+[orig_h=141.142.220.118, orig_p=48479/udp, resp_h=141.142.2.2, resp_p=53/udp], 8b9q7qPtzhd
+[orig_h=141.142.220.118, orig_p=48479/udp, resp_h=141.142.2.2, resp_p=53/udp], 8b9q7qPtzhd
+[orig_h=141.142.220.118, orig_p=48128/udp, resp_h=141.142.2.2, resp_p=53/udp], KOdlL7sC9z2
+[orig_h=141.142.220.118, orig_p=48128/udp, resp_h=141.142.2.2, resp_p=53/udp], KOdlL7sC9z2
+[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], hvOo97vj60k
+[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], hvOo97vj60k
+[orig_h=141.142.220.118, orig_p=56056/udp, resp_h=141.142.2.2, resp_p=53/udp], FHu81uYujA9
+[orig_h=141.142.220.118, orig_p=56056/udp, resp_h=141.142.2.2, resp_p=53/udp], FHu81uYujA9
+[orig_h=141.142.220.118, orig_p=55092/udp, resp_h=141.142.2.2, resp_p=53/udp], 2M1wDTa0C7a
+[orig_h=141.142.220.118, orig_p=55092/udp, resp_h=141.142.2.2, resp_p=53/udp], 2M1wDTa0C7a
+[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], OKiJdtzKWPk
+[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], OKiJdtzKWPk
+[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], UZkBBvjF0r8
+[orig_h=141.142.220.118, orig_p=49997/tcp, resp_h=208.80.152.3, resp_p=80/tcp], UZkBBvjF0r8
+[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], svqqNKN9CFj
+[orig_h=141.142.220.118, orig_p=49996/tcp, resp_h=208.80.152.3, resp_p=80/tcp], svqqNKN9CFj
+[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OldlyspNIr7
+[orig_h=141.142.220.118, orig_p=49998/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OldlyspNIr7
+[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], j5w2LueK8Ti
+[orig_h=141.142.220.118, orig_p=50000/tcp, resp_h=208.80.152.3, resp_p=80/tcp], j5w2LueK8Ti
+[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OPM7xFSDNw3
+[orig_h=141.142.220.118, orig_p=49999/tcp, resp_h=208.80.152.3, resp_p=80/tcp], OPM7xFSDNw3
+[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], hvOo97vj60k
+[orig_h=141.142.220.118, orig_p=50001/tcp, resp_h=208.80.152.3, resp_p=80/tcp], hvOo97vj60k
+[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], OKiJdtzKWPk
+[orig_h=141.142.220.118, orig_p=35642/tcp, resp_h=208.80.152.2, resp_p=80/tcp], OKiJdtzKWPk
+[orig_h=141.142.220.235, orig_p=6705/tcp, resp_h=173.192.163.128, resp_p=80/tcp], tpUWfNdSLE
+[orig_h=141.142.220.235, orig_p=6705/tcp, resp_h=173.192.163.128, resp_p=80/tcp], tpUWfNdSLE
+[orig_h=141.142.220.44, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], ra1C6ZLut4b
+[orig_h=141.142.220.44, orig_p=5353/udp, resp_h=224.0.0.251, resp_p=5353/udp], ra1C6ZLut4b
+[orig_h=141.142.220.226, orig_p=137/udp, resp_h=141.142.220.255, resp_p=137/udp], UElDH5b9qA5
+[orig_h=141.142.220.226, orig_p=137/udp, resp_h=141.142.220.255, resp_p=137/udp], UElDH5b9qA5
+[orig_h=141.142.220.226, orig_p=55131/udp, resp_h=224.0.0.252, resp_p=5355/udp], sO3mBXBav1h
+[orig_h=141.142.220.226, orig_p=55131/udp, resp_h=224.0.0.252, resp_p=5355/udp], sO3mBXBav1h
+[orig_h=141.142.220.226, orig_p=55671/udp, resp_h=224.0.0.252, resp_p=5355/udp], xAQqZE8Wdp4
+[orig_h=141.142.220.226, orig_p=55671/udp, resp_h=224.0.0.252, resp_p=5355/udp], xAQqZE8Wdp4
+[orig_h=141.142.220.238, orig_p=56641/udp, resp_h=141.142.220.255, resp_p=137/udp], zVecVnfOlsf
+[orig_h=141.142.220.238, orig_p=56641/udp, resp_h=141.142.220.255, resp_p=137/udp], zVecVnfOlsf
diff --git a/testing/btest/Baseline/core.print-bpf-filters-ipv4/conn.log b/testing/btest/Baseline/core.print-bpf-filters-ipv4/conn.log
new file mode 100644
index 0000000000..fc0008ea13
--- /dev/null
+++ b/testing/btest/Baseline/core.print-bpf-filters-ipv4/conn.log
@@ -0,0 +1 @@
+1128727435.450898 1.733303 141.42.64.125 125.190.109.199 http 56730 80 tcp 98 9417 SF X
diff --git a/testing/btest/Baseline/core.print-bpf-filters-ipv4/output b/testing/btest/Baseline/core.print-bpf-filters-ipv4/output
new file mode 100644
index 0000000000..2b517e8666
--- /dev/null
+++ b/testing/btest/Baseline/core.print-bpf-filters-ipv4/output
@@ -0,0 +1,4 @@
+not ip6
+not ip6
+(not ip6) and (tcp[13] & 7 != 0)
+port 42
diff --git a/testing/btest/Baseline/core.print-bpf-filters-ipv6/conn.log b/testing/btest/Baseline/core.print-bpf-filters-ipv6/conn.log
new file mode 100644
index 0000000000..fc0008ea13
--- /dev/null
+++ b/testing/btest/Baseline/core.print-bpf-filters-ipv6/conn.log
@@ -0,0 +1 @@
+1128727435.450898 1.733303 141.42.64.125 125.190.109.199 http 56730 80 tcp 98 9417 SF X
diff --git a/testing/btest/Baseline/core.print-bpf-filters-ipv6/output b/testing/btest/Baseline/core.print-bpf-filters-ipv6/output
new file mode 100644
index 0000000000..56189b3d9f
--- /dev/null
+++ b/testing/btest/Baseline/core.print-bpf-filters-ipv6/output
@@ -0,0 +1,4 @@
+ip or not ip
+ip or not ip
+tcp[13] & 7 != 0
+port 42
diff --git a/testing/btest/Baseline/core.vlan-mpls/conn.log b/testing/btest/Baseline/core.vlan-mpls/conn.log
new file mode 100644
index 0000000000..229842e24f
--- /dev/null
+++ b/testing/btest/Baseline/core.vlan-mpls/conn.log
@@ -0,0 +1,3 @@
+952109346.874907 2.102560 10.1.2.1 10.34.0.1 telnet 11001 23 tcp 25 ? SH X cc=1
+1128727435.450898 1.733303 141.42.64.125 125.190.109.199 http 56730 80 tcp 98 9417 SF X
+1278600802.069419 0.004152 10.20.80.1 10.0.0.15 http 50343 80 tcp 9 3429 SF X
diff --git a/testing/btest/Baseline/doc.autogen-reST-example/example.rst b/testing/btest/Baseline/doc.autogen-reST-example/example.rst
index eb125eda23..516b7b51aa 100644
--- a/testing/btest/Baseline/doc.autogen-reST-example/example.rst
+++ b/testing/btest/Baseline/doc.autogen-reST-example/example.rst
@@ -13,11 +13,23 @@ these comments are transferred directly into the auto-generated
 `reStructuredText <http://docutils.sourceforge.net/rst.html>`_
 (reST) document's summary section.
 
-.. tip:: You can embed directives and roles within ``##``-stylized comments
+.. tip:: You can embed directives and roles within ``##``-stylized comments.
+
+A script's logging information has to be documented manually as minimally
+shown below.  Note that references may not always be possible (e.g.
+anonymous filter functions) and a script may not need to document
+each of "columns", "event", "filter" depending on exactly what it's doing.
+
+**Logging Stream ID:** :bro:enum:`Example::EXAMPLE`
+    :Columns:    :bro:type:`Example::Info`
+    :Event:      :bro:id:`Example::log_example`
+    :Filter:     ``example-filter``
+        uses :bro:id:`Example::filter_func` to determine whether to
+        exclude the ``ts`` field
 
 :Author: Jon Siwek <jsiwek@ncsa.illinois.edu>
 
-:Imports: :doc:`notice`
+:Imports: :doc:`notice </policy/notice>`
 
 Summary
 ~~~~~~~
@@ -49,13 +61,20 @@ Types
                                                        goes here.
 
 :bro:type:`Example::ComplexRecord`: :bro:type:`record` general documentation for a type "ComplexRecord" goes here
+
+:bro:type:`Example::Info`: :bro:type:`record`          An example record to be used with a logging stream.
 ====================================================== ==========================================================
 
 Events
 ######
-============================================== ==========================
-:bro:id:`Example::an_event`: :bro:type:`event` Summarize "an_event" here.
-============================================== ==========================
+================================================= =============================================================
+:bro:id:`Example::an_event`: :bro:type:`event`    Summarize "an_event" here.
+
+:bro:id:`Example::log_example`: :bro:type:`event` This is a declaration of an example event that can be used in
+                                                  logging streams and is raised once for each log entry.
+
+:bro:id:`bro_init`: :bro:type:`event`
+================================================= =============================================================
 
 Functions
 #########
@@ -65,9 +84,13 @@ Functions
 
 Redefinitions
 #############
-================================================= ====================================
-:bro:type:`Example::SimpleEnum`: :bro:type:`enum` document the "SimpleEnum" redef here
-================================================= ====================================
+===================================================== ========================================
+:bro:type:`Log::ID`: :bro:type:`enum`
+
+:bro:type:`Example::SimpleEnum`: :bro:type:`enum`     document the "SimpleEnum" redef here
+
+:bro:type:`Example::SimpleRecord`: :bro:type:`record` document the record extension redef here
+===================================================== ========================================
 
 Namespaces
 ~~~~~~~~~~
@@ -180,6 +203,18 @@ Types
 
    general documentation for a type "ComplexRecord" goes here
 
+.. bro:type:: Example::Info
+
+   :Type: :bro:type:`record`
+
+      ts: :bro:type:`time` :bro:attr:`&log`
+
+      uid: :bro:type:`string` :bro:attr:`&log`
+
+      status: :bro:type:`count` :bro:attr:`&log` :bro:attr:`&optional`
+
+   An example record to be used with a logging stream.
+
 Events
 ~~~~~~
 .. bro:id:: Example::an_event
@@ -191,6 +226,17 @@ Events
    
    :param name: describe the argument here
 
+.. bro:id:: Example::log_example
+
+   :Type: :bro:type:`event` (rec: :bro:type:`Example::Info`)
+
+   This is a declaration of an example event that can be used in
+   logging streams and is raised once for each log entry.
+
+.. bro:id:: bro_init
+
+   :Type: :bro:type:`event` ()
+
 Functions
 ~~~~~~~~~
 .. bro:id:: Example::a_function
@@ -213,6 +259,12 @@ Functions
 
 Redefinitions
 ~~~~~~~~~~~~~
+:bro:type:`Log::ID`
+
+   :Type: :bro:type:`enum`
+
+      .. bro:enum:: Example::EXAMPLE Log::ID
+
 :bro:type:`Example::SimpleEnum`
 
    :Type: :bro:type:`enum`
@@ -227,6 +279,16 @@ Redefinitions
 
    document the "SimpleEnum" redef here
 
+:bro:type:`Example::SimpleRecord`
+
+   :Type: :bro:type:`record`
+
+      field_ext: :bro:type:`string` :bro:attr:`&optional`
+         document the extending field here
+         (or here)
+
+   document the record extension redef here
+
 Port Analysis
 -------------
 :ref:`More Information <common_port_analysis_doc>`
@@ -234,8 +296,8 @@ Port Analysis
 SSL::
 
     [ports={
-        563/tcp,
-        443/tcp
+        443/tcp,
+        562/tcp
     }]
 
 Packet Filter
@@ -244,8 +306,8 @@ Packet Filter
 
 Filters added::
 
-    [nntps] = tcp port 563,
-    [ssl] = tcp port 443
+    [ssl] = tcp port 443,
+    [nntps] = tcp port 562
 
 Private Interface
 -----------------
@@ -260,8 +322,8 @@ State Variables
    ::
 
       {
-         563/tcp,
-         443/tcp
+         443/tcp,
+         562/tcp
       }
 
 Types
@@ -276,6 +338,10 @@ Types
 
 Functions
 ~~~~~~~~~
+.. bro:id:: Example::filter_func
+
+   :Type: :bro:type:`function` (rec: :bro:type:`Example::Info`) : :bro:type:`bool`
+
 .. bro:id:: Example::function_without_proto
 
    :Type: :bro:type:`function` (tag: :bro:type:`string`) : :bro:type:`string`
diff --git a/testing/btest/Baseline/doc.autogen-reST-type-aliases/autogen-reST-type-aliases.rst b/testing/btest/Baseline/doc.autogen-reST-type-aliases/autogen-reST-type-aliases.rst
index 14250f217b..b24d7a01ab 100644
--- a/testing/btest/Baseline/doc.autogen-reST-type-aliases/autogen-reST-type-aliases.rst
+++ b/testing/btest/Baseline/doc.autogen-reST-type-aliases/autogen-reST-type-aliases.rst
@@ -24,7 +24,7 @@ Types
 ============================================ ==========================================================================
 :bro:type:`TypeAlias`: :bro:type:`bool`      This is just an alias for a builtin type ``bool``.
 
-:bro:type:`OtherTypeAlias`: :bro:type:`bool` We decided that creating alias "chains" might now be so useful to document
+:bro:type:`OtherTypeAlias`: :bro:type:`bool` We decided that creating alias "chains" might not be so useful to document
                                              so this type just creates a cross reference to ``bool``.
 ============================================ ==========================================================================
 
@@ -56,6 +56,6 @@ Types
 
    :Type: :bro:type:`bool`
 
-   We decided that creating alias "chains" might now be so useful to document
+   We decided that creating alias "chains" might not be so useful to document
    so this type just creates a cross reference to ``bool``.
 
diff --git a/testing/btest/Baseline/istate.persistence/vars.read.log b/testing/btest/Baseline/istate.persistence/vars.read.log
index 74d5bae072..a141deb9a8 100644
--- a/testing/btest/Baseline/istate.persistence/vars.read.log
+++ b/testing/btest/Baseline/istate.persistence/vars.read.log
@@ -7,22 +7,22 @@ Hallihallo
 131.159
 42.0 secs
 {
-[1] = qwerty,
-[2] = uiop
+[2] = uiop,
+[1] = qwerty
 }
 file "test" of string
 /^?(12345)$?/
 {
+2,
 4,
 1,
 5,
-3,
-2
+3
 }
 {
-[1, ABC] = 101,
+[2, DEF] = 102,
 [3, GHI] = 103,
-[2, DEF] = 102
+[1, ABC] = 101
 }
 {
 [12346] = /^?(12345)$?/,
diff --git a/testing/btest/Baseline/istate.persistence/vars.write.log b/testing/btest/Baseline/istate.persistence/vars.write.log
index 74d5bae072..a141deb9a8 100644
--- a/testing/btest/Baseline/istate.persistence/vars.write.log
+++ b/testing/btest/Baseline/istate.persistence/vars.write.log
@@ -7,22 +7,22 @@ Hallihallo
 131.159
 42.0 secs
 {
-[1] = qwerty,
-[2] = uiop
+[2] = uiop,
+[1] = qwerty
 }
 file "test" of string
 /^?(12345)$?/
 {
+2,
 4,
 1,
 5,
-3,
-2
+3
 }
 {
-[1, ABC] = 101,
+[2, DEF] = 102,
 [3, GHI] = 103,
-[2, DEF] = 102
+[1, ABC] = 101
 }
 {
 [12346] = /^?(12345)$?/,
diff --git a/testing/istate/base/python-bro/stdout.log b/testing/btest/Baseline/istate.pybroccoli/bro..stdout
similarity index 84%
rename from testing/istate/base/python-bro/stdout.log
rename to testing/btest/Baseline/istate.pybroccoli/bro..stdout
index bdfea5e4d7..6b74681745 100644
--- a/testing/istate/base/python-bro/stdout.log
+++ b/testing/btest/Baseline/istate.pybroccoli/bro..stdout
@@ -1,7 +1,7 @@
 ==== atomic
 -10
 2
-xxxxxxxxxx.xxxxxx
+1304213412.67992
 2.0 mins
 F
 1.5
diff --git a/testing/istate/base/python-script/stdout.log b/testing/btest/Baseline/istate.pybroccoli/python..stdout.filtered
similarity index 82%
rename from testing/istate/base/python-script/stdout.log
rename to testing/btest/Baseline/istate.pybroccoli/python..stdout.filtered
index 5af3e6a47e..39ef913c17 100644
--- a/testing/istate/base/python-script/stdout.log
+++ b/testing/btest/Baseline/istate.pybroccoli/python..stdout.filtered
@@ -1,7 +1,7 @@
 ==== atomic a 1 ====
--4 -4
+-4L -4
 42 42
-xxxxxxxxxx.xxxxxx xxxxxxxxxx.xxxxxx
+1304213412.7213531 1304213412.72
 60.0 60.0
 True True
 3.1400000000000001 3.14
@@ -11,9 +11,9 @@ True True
 'X.X.X' X.X.X
 'X.X.X' 22.33.44.0/24
 ==== atomic a 2 ====
--10 -10
+-10L -10
 2 2
-xxxxxxxxxx.xxxxxx xxxxxxxxxx.xxxxxx
+1304213412.6799209 1304213412.68
 120.0 120.0
 False False
 1.5 1.5
@@ -23,9 +23,9 @@ False False
 'X.X.X' X.X.X
 'X.X.X' 192.168.0.0/16
 ==== atomic b 2 ====
--10 -10
+-10L -10
 <broccoli.count instance at > 2
-<broccoli.time instance at > xxxxxxxxxx.xxxxxx
+<broccoli.time instance at > 1304213412.68
 <broccoli.interval instance at > 120.0
 False False
 1.5 1.5
@@ -36,9 +36,9 @@ False False
 <broccoli.net instance at > 192.168.0.0/16
 ==== record 1 ====
 <broccoli.record instance at >
-42 42
+42L 42
 '6.6.7.7' 6.6.7.7
 ==== record 2 ====
 <broccoli.record instance at >
-99 99
+99L 99
 '3.4.5.1' 3.4.5.1
diff --git a/testing/btest/Baseline/istate.sync/receiver.vars.log b/testing/btest/Baseline/istate.sync/receiver.vars.log
index 2d7f88c7da..124c162579 100644
--- a/testing/btest/Baseline/istate.sync/receiver.vars.log
+++ b/testing/btest/Baseline/istate.sync/receiver.vars.log
@@ -13,22 +13,22 @@ Jodel
 file "test2" of string
 /^?(abbcdefgh)$?/
 {
+2,
 4,
-5,
-3,
 6,
-2
+5,
+3
 }
 {
-[3, GHI] = 103,
 [2, DEF] = 103,
+[3, GHI] = 103,
 [4, JKL] = 104
 }
 {
-[6767] = /^?(QWERTZ)$?/,
 [12346] = /^?(12345)$?/,
+[6767] = /^?(QWERTZ)$?/,
 [12345] = /^?(12345)$?/
 }
 6667/tcp
 [2, 20, 3, 4]
-[a=zxzxzx, b=[a=pop, b=43, c=9.999], c=[a=IOIOI, b=201, c=612.2], d=6.6666]
+[a=zxzxzx, b=[a=pop, b=43, c=9.999], c=[a=IOIOI, b=201, c=612.2], d=6.6666, e=<uninitialized>]
diff --git a/testing/btest/Baseline/istate.sync/sender.vars.log b/testing/btest/Baseline/istate.sync/sender.vars.log
index 2d7f88c7da..124c162579 100644
--- a/testing/btest/Baseline/istate.sync/sender.vars.log
+++ b/testing/btest/Baseline/istate.sync/sender.vars.log
@@ -13,22 +13,22 @@ Jodel
 file "test2" of string
 /^?(abbcdefgh)$?/
 {
+2,
 4,
-5,
-3,
 6,
-2
+5,
+3
 }
 {
-[3, GHI] = 103,
 [2, DEF] = 103,
+[3, GHI] = 103,
 [4, JKL] = 104
 }
 {
-[6767] = /^?(QWERTZ)$?/,
 [12346] = /^?(12345)$?/,
+[6767] = /^?(QWERTZ)$?/,
 [12345] = /^?(12345)$?/
 }
 6667/tcp
 [2, 20, 3, 4]
-[a=zxzxzx, b=[a=pop, b=43, c=9.999], c=[a=IOIOI, b=201, c=612.2], d=6.6666]
+[a=zxzxzx, b=[a=pop, b=43, c=9.999], c=[a=IOIOI, b=201, c=612.2], d=6.6666, e=<uninitialized>]
diff --git a/testing/btest/Baseline/language.cross-product-init/output b/testing/btest/Baseline/language.cross-product-init/output
new file mode 100644
index 0000000000..95794f9179
--- /dev/null
+++ b/testing/btest/Baseline/language.cross-product-init/output
@@ -0,0 +1,6 @@
+{
+[bar, 1.2.0.0/19] ,
+[foo, 5.6.0.0/21] ,
+[bar, 5.6.0.0/21] ,
+[foo, 1.2.0.0/19] 
+}
diff --git a/testing/btest/Baseline/language.delete-field-set/output b/testing/btest/Baseline/language.delete-field-set/output
new file mode 100644
index 0000000000..ccf6dbc793
--- /dev/null
+++ b/testing/btest/Baseline/language.delete-field-set/output
@@ -0,0 +1 @@
+[a=<uninitialized>, b=<uninitialized>, c=<uninitialized>]
diff --git a/testing/btest/Baseline/language.delete-field/output b/testing/btest/Baseline/language.delete-field/output
new file mode 100644
index 0000000000..12d04d02d3
--- /dev/null
+++ b/testing/btest/Baseline/language.delete-field/output
@@ -0,0 +1,4 @@
+a: 20
+20
+a: not set
+5
diff --git a/testing/btest/Baseline/language.enum-scope/output b/testing/btest/Baseline/language.enum-scope/output
new file mode 100644
index 0000000000..f2ad6c76f0
--- /dev/null
+++ b/testing/btest/Baseline/language.enum-scope/output
@@ -0,0 +1 @@
+c
diff --git a/testing/btest/Baseline/language.match-test/output b/testing/btest/Baseline/language.match-test/output
new file mode 100644
index 0000000000..5ee7ba029d
--- /dev/null
+++ b/testing/btest/Baseline/language.match-test/output
@@ -0,0 +1,3 @@
+default
+it's big
+it's really big
diff --git a/testing/btest/Baseline/language.match-test2/output b/testing/btest/Baseline/language.match-test2/output
new file mode 100644
index 0000000000..0cfbf08886
--- /dev/null
+++ b/testing/btest/Baseline/language.match-test2/output
@@ -0,0 +1 @@
+2
diff --git a/testing/btest/Baseline/language.next-test/output b/testing/btest/Baseline/language.next-test/output
new file mode 100644
index 0000000000..db9ce4efa4
--- /dev/null
+++ b/testing/btest/Baseline/language.next-test/output
@@ -0,0 +1,8 @@
+0
+1
+1
+MIDDLE
+0
+0
+1
+THE END
diff --git a/testing/btest/Baseline/language.rare-events/output b/testing/btest/Baseline/language.rare-events/output
new file mode 100644
index 0000000000..1de3641284
--- /dev/null
+++ b/testing/btest/Baseline/language.rare-events/output
@@ -0,0 +1 @@
+1106953531.452525 DroppedPackets 2 packets dropped after filtering, 1109 received, 10000 on link
diff --git a/testing/btest/Baseline/language.rec-comp-init/output b/testing/btest/Baseline/language.rec-comp-init/output
new file mode 100644
index 0000000000..fedb9177c7
--- /dev/null
+++ b/testing/btest/Baseline/language.rec-comp-init/output
@@ -0,0 +1,5 @@
+[a={
+
+}, b={
+
+}, c=[]]
diff --git a/testing/btest/Baseline/language.rec-of-tbl/output b/testing/btest/Baseline/language.rec-of-tbl/output
new file mode 100644
index 0000000000..f7c06f0b63
--- /dev/null
+++ b/testing/btest/Baseline/language.rec-of-tbl/output
@@ -0,0 +1,3 @@
+[a={
+[5] = 3
+}]
diff --git a/testing/btest/Baseline/language.rec-table-default/output b/testing/btest/Baseline/language.rec-table-default/output
index 845fd8354d..a1531d06ee 100644
--- a/testing/btest/Baseline/language.rec-table-default/output
+++ b/testing/btest/Baseline/language.rec-table-default/output
@@ -5,9 +5,9 @@
 
 }
 {
-C,
 A,
-B
+B,
+C
 }
 {
 
diff --git a/testing/btest/Baseline/language.record-recursive-coercion/output b/testing/btest/Baseline/language.record-recursive-coercion/output
new file mode 100644
index 0000000000..37c916713f
--- /dev/null
+++ b/testing/btest/Baseline/language.record-recursive-coercion/output
@@ -0,0 +1 @@
+[major=4, minor=4, minor2=<uninitialized>, addl=<uninitialized>]
diff --git a/testing/btest/Baseline/language.sizeof/output b/testing/btest/Baseline/language.sizeof/output
new file mode 100644
index 0000000000..0c1f3448c6
--- /dev/null
+++ b/testing/btest/Baseline/language.sizeof/output
@@ -0,0 +1,17 @@
+Address 1.2.3.4: 16909060
+Boolean T: 1
+Count 10: 10
+Double -1.23: 1.230000
+Enum ENUM3: 2
+File 21.000000
+Function add_interface: 2
+Integer -10: 10
+Interval -5.0 secs: 5.000000
+Net 192.168.0: 65536.000000
+Port 80/tcp: 65616
+Record [i=10, j=<uninitialized>, k=<uninitialized>]: 3
+Set: 3
+String 'Hello': 5
+Subnet 192.168.0.0/24: 256.000000
+Table 2
+Vector [Hello, , , , World]: 5
diff --git a/testing/btest/Baseline/language.smith-waterman-test/output b/testing/btest/Baseline/language.smith-waterman-test/output
new file mode 100644
index 0000000000..b0d0d33526
--- /dev/null
+++ b/testing/btest/Baseline/language.smith-waterman-test/output
@@ -0,0 +1,32 @@
+abcdefgh - ijklmnop:
+AAAabcefghij - lmnopAAAqrst:
+tok 1: AAA (0/5, T)
+abcAAAefghij - lmnopAAAqrst:
+tok 1: AAA (3/5, T)
+abcefghijAAA - lmnopAAAqrst:
+tok 1: AAA (9/5, T)
+xxxAAAyyy - AAAaAAAbAAA:
+tok 1: AAA (3/0, T)
+tok 2: AAA (3/4, T)
+tok 3: AAA (3/8, T)
+AAAaAAAbAAA - xxxAAAyyy:
+tok 1: AAA (0/3, T)
+tok 2: AAA (4/3, T)
+tok 3: AAA (8/3, T)
+xxCDyABzCDyABzz - ABCD:
+tok 1: CD (2/2, T)
+tok 2: AB (5/0, T)
+tok 3: CD (8/2, F)
+tok 4: AB (11/0, T)
+ABCD - xxCDyABzCDyABzz:
+tok 1: CD (2/2, T)
+tok 2: AB (0/5, T)
+tok 3: CD (2/8, F)
+tok 4: AB (0/11, T)
+Cache-control: no-cache^M^JAccept: - Accept-: deflate^M^JAccept-: Accept-:
+tok 1: Accept (27/0, T)
+tok 2: e^M^JAccept (22/15, T)
+tok 3: Accept (27/29, T)
+xxAAxxAAxx - yyyyyAAyyyyy:
+tok 1: AA (2/5, T)
+tok 2: AA (6/5, T)
diff --git a/testing/btest/Baseline/language.strings/output b/testing/btest/Baseline/language.strings/output
new file mode 100644
index 0000000000..525ce64916
--- /dev/null
+++ b/testing/btest/Baseline/language.strings/output
@@ -0,0 +1,25 @@
+Input string: broisaveryneatids
+
+String splitting
+----------------
+Splitting 'broisaveryneatids' at 6 points...
+bro
+is
+a
+very
+neat
+ids
+
+Substrings
+----------
+3@0: bro
+5@2: roisa
+7@4: isavery
+10@10: yneatids
+
+Finding strings
+---------------
+isa: 4
+very: 7
+ids: 15
+nono: 0
diff --git a/testing/btest/Baseline/language.wrong-delete-field/output b/testing/btest/Baseline/language.wrong-delete-field/output
new file mode 100644
index 0000000000..8d965362f1
--- /dev/null
+++ b/testing/btest/Baseline/language.wrong-delete-field/output
@@ -0,0 +1 @@
+/da/home/robin/bro/master/testing/btest/.tmp/language.wrong-delete-field/wrong-delete-field.bro, line 10 (delete x$a): error, illegal delete statement
diff --git a/testing/btest/Baseline/logging.remote-types/receiver.ssh.log b/testing/btest/Baseline/logging.remote-types/receiver.ssh.log
index d703c68b96..9a203f1bac 100644
--- a/testing/btest/Baseline/logging.remote-types/receiver.ssh.log
+++ b/testing/btest/Baseline/logging.remote-types/receiver.ssh.log
@@ -1,2 +1,2 @@
 # b	i	e	c	p	sn	n	a	d	t	iv	s	sc	ss	se	vc	ve
-T	-42	SSH::SSH	21	123	10.0.0.0/24	10.0.0.0	1.2.3.4	3.14	1303439439.02908	100.0	hurz	1,4,2,3	CC,AA,BB	EMPTY	10,20,30	EMPTY
+T	-42	SSH::SSH	21	123	10.0.0.0/24	10.0.0.0	1.2.3.4	3.14	1303580757.69082	100.0	hurz	2,4,1,3	CC,AA,BB	EMPTY	10,20,30	EMPTY
diff --git a/testing/btest/Baseline/logging.remote/sender.ssh.failure.log b/testing/btest/Baseline/logging.remote/sender.ssh.failure.log
index 815b0366b3..ce48f547f6 100644
--- a/testing/btest/Baseline/logging.remote/sender.ssh.failure.log
+++ b/testing/btest/Baseline/logging.remote/sender.ssh.failure.log
@@ -1,4 +1,4 @@
 # t	id.orig_h	id.orig_p	id.resp_h	id.resp_p	status	country
-1299718503.72819	1.2.3.4	1234	2.3.4.5	80	failure	US
-1299718503.72819	1.2.3.4	1234	2.3.4.5	80	failure	UK
-1299718503.72819	1.2.3.4	1234	2.3.4.5	80	failure	MX
+1303580768.27075	1.2.3.4	1234	2.3.4.5	80	failure	US
+1303580768.27075	1.2.3.4	1234	2.3.4.5	80	failure	UK
+1303580768.27075	1.2.3.4	1234	2.3.4.5	80	failure	MX
diff --git a/testing/btest/Baseline/logging.remote/sender.ssh.log b/testing/btest/Baseline/logging.remote/sender.ssh.log
index 2f159ad6a7..eb392df781 100644
--- a/testing/btest/Baseline/logging.remote/sender.ssh.log
+++ b/testing/btest/Baseline/logging.remote/sender.ssh.log
@@ -1,6 +1,6 @@
 # t	id.orig_h	id.orig_p	id.resp_h	id.resp_p	status	country
-1299718503.72819	1.2.3.4	1234	2.3.4.5	80	success	-
-1299718503.72819	1.2.3.4	1234	2.3.4.5	80	failure	US
-1299718503.72819	1.2.3.4	1234	2.3.4.5	80	failure	UK
-1299718503.72819	1.2.3.4	1234	2.3.4.5	80	success	BR
-1299718503.72819	1.2.3.4	1234	2.3.4.5	80	failure	MX
+1303580768.27075	1.2.3.4	1234	2.3.4.5	80	success	-
+1303580768.27075	1.2.3.4	1234	2.3.4.5	80	failure	US
+1303580768.27075	1.2.3.4	1234	2.3.4.5	80	failure	UK
+1303580768.27075	1.2.3.4	1234	2.3.4.5	80	success	BR
+1303580768.27075	1.2.3.4	1234	2.3.4.5	80	failure	MX
diff --git a/testing/btest/Baseline/logging.remote/sender.ssh.success.log b/testing/btest/Baseline/logging.remote/sender.ssh.success.log
index 2838cc68b8..3861250477 100644
--- a/testing/btest/Baseline/logging.remote/sender.ssh.success.log
+++ b/testing/btest/Baseline/logging.remote/sender.ssh.success.log
@@ -1,3 +1,3 @@
 # t	id.orig_h	id.orig_p	id.resp_h	id.resp_p	status	country
-1299718503.72819	1.2.3.4	1234	2.3.4.5	80	success	-
-1299718503.72819	1.2.3.4	1234	2.3.4.5	80	success	BR
+1303580768.27075	1.2.3.4	1234	2.3.4.5	80	success	-
+1303580768.27075	1.2.3.4	1234	2.3.4.5	80	success	BR
diff --git a/testing/btest/Baseline/logging.rotate-custom/out b/testing/btest/Baseline/logging.rotate-custom/out
index f0d9185aa3..c87445cff5 100644
--- a/testing/btest/Baseline/logging.rotate-custom/out
+++ b/testing/btest/Baseline/logging.rotate-custom/out
@@ -28,107 +28,56 @@
 2nd test2-11-03-07_12.00.05.log test2.log 11-03-07_12.00.05 11-03-07_12.59.55 0
 1st test-11-03-07_12.00.05.log test.log 11-03-07_12.00.05 11-03-07_12.59.55 1
 2nd test2-11-03-07_12.59.55.log test2.log 11-03-07_12.59.55 11-03-07_12.59.55 1
+# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
+1299466805.0	10.0.0.1	20	10.0.0.2	1024
+1299470395.0	10.0.0.2	20	10.0.0.3	0
+1299470405.0	10.0.0.1	20	10.0.0.2	1025
+1299473995.0	10.0.0.2	20	10.0.0.3	1
+1299474005.0	10.0.0.1	20	10.0.0.2	1026
+1299477595.0	10.0.0.2	20	10.0.0.3	2
+1299477605.0	10.0.0.1	20	10.0.0.2	1027
+1299481195.0	10.0.0.2	20	10.0.0.3	3
+1299481205.0	10.0.0.1	20	10.0.0.2	1028
+1299484795.0	10.0.0.2	20	10.0.0.3	4
+1299484805.0	10.0.0.1	20	10.0.0.2	1029
+1299488395.0	10.0.0.2	20	10.0.0.3	5
+1299488405.0	10.0.0.1	20	10.0.0.2	1030
+1299491995.0	10.0.0.2	20	10.0.0.3	6
+1299492005.0	10.0.0.1	20	10.0.0.2	1031
+1299495595.0	10.0.0.2	20	10.0.0.3	7
+1299495605.0	10.0.0.1	20	10.0.0.2	1032
+1299499195.0	10.0.0.2	20	10.0.0.3	8
+1299499205.0	10.0.0.1	20	10.0.0.2	1033
+1299502795.0	10.0.0.2	20	10.0.0.3	9
 > test-11-03-07_03.00.05.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299466805.0	10.0.0.1	20	10.0.0.2	1024
-1299470395.0	10.0.0.2	20	10.0.0.3	0
 > test-11-03-07_04.00.05.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299470405.0	10.0.0.1	20	10.0.0.2	1025
-1299473995.0	10.0.0.2	20	10.0.0.3	1
 > test-11-03-07_05.00.05.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299474005.0	10.0.0.1	20	10.0.0.2	1026
-1299477595.0	10.0.0.2	20	10.0.0.3	2
 > test-11-03-07_06.00.05.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299477605.0	10.0.0.1	20	10.0.0.2	1027
-1299481195.0	10.0.0.2	20	10.0.0.3	3
 > test-11-03-07_07.00.05.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299481205.0	10.0.0.1	20	10.0.0.2	1028
-1299484795.0	10.0.0.2	20	10.0.0.3	4
 > test-11-03-07_08.00.05.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299484805.0	10.0.0.1	20	10.0.0.2	1029
-1299488395.0	10.0.0.2	20	10.0.0.3	5
 > test-11-03-07_09.00.05.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299488405.0	10.0.0.1	20	10.0.0.2	1030
-1299491995.0	10.0.0.2	20	10.0.0.3	6
 > test-11-03-07_10.00.05.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299492005.0	10.0.0.1	20	10.0.0.2	1031
-1299495595.0	10.0.0.2	20	10.0.0.3	7
 > test-11-03-07_11.00.05.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299495605.0	10.0.0.1	20	10.0.0.2	1032
-1299499195.0	10.0.0.2	20	10.0.0.3	8
 > test-11-03-07_12.00.05.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299499205.0	10.0.0.1	20	10.0.0.2	1033
-1299502795.0	10.0.0.2	20	10.0.0.3	9
-> test2-11-03-07_03.00.05.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299466805.0	10.0.0.1	20	10.0.0.2	1024
-> test2-11-03-07_03.59.55.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299470395.0	10.0.0.2	20	10.0.0.3	0
-> test2-11-03-07_04.00.05.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299470405.0	10.0.0.1	20	10.0.0.2	1025
-> test2-11-03-07_04.59.55.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299473995.0	10.0.0.2	20	10.0.0.3	1
-> test2-11-03-07_05.00.05.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299474005.0	10.0.0.1	20	10.0.0.2	1026
-> test2-11-03-07_05.59.55.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299477595.0	10.0.0.2	20	10.0.0.3	2
-> test2-11-03-07_06.00.05.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299477605.0	10.0.0.1	20	10.0.0.2	1027
-> test2-11-03-07_06.59.55.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299481195.0	10.0.0.2	20	10.0.0.3	3
-> test2-11-03-07_07.00.05.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299481205.0	10.0.0.1	20	10.0.0.2	1028
-> test2-11-03-07_07.59.55.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299484795.0	10.0.0.2	20	10.0.0.3	4
-> test2-11-03-07_08.00.05.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299484805.0	10.0.0.1	20	10.0.0.2	1029
-> test2-11-03-07_08.59.55.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299488395.0	10.0.0.2	20	10.0.0.3	5
-> test2-11-03-07_09.00.05.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299488405.0	10.0.0.1	20	10.0.0.2	1030
-> test2-11-03-07_09.59.55.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299491995.0	10.0.0.2	20	10.0.0.3	6
-> test2-11-03-07_10.00.05.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299492005.0	10.0.0.1	20	10.0.0.2	1031
-> test2-11-03-07_10.59.55.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299495595.0	10.0.0.2	20	10.0.0.3	7
-> test2-11-03-07_11.00.05.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299495605.0	10.0.0.1	20	10.0.0.2	1032
-> test2-11-03-07_11.59.55.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299499195.0	10.0.0.2	20	10.0.0.3	8
-> test2-11-03-07_12.00.05.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299499205.0	10.0.0.1	20	10.0.0.2	1033
-> test2-11-03-07_12.59.55.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
-1299502795.0	10.0.0.2	20	10.0.0.3	9
-> test2.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
 > test.log
-# t	id.orig_h	id.orig_p	id.resp_h	id.resp_p
+> test2-11-03-07_03.00.05.log
+> test2-11-03-07_03.59.55.log
+> test2-11-03-07_04.00.05.log
+> test2-11-03-07_04.59.55.log
+> test2-11-03-07_05.00.05.log
+> test2-11-03-07_05.59.55.log
+> test2-11-03-07_06.00.05.log
+> test2-11-03-07_06.59.55.log
+> test2-11-03-07_07.00.05.log
+> test2-11-03-07_07.59.55.log
+> test2-11-03-07_08.00.05.log
+> test2-11-03-07_08.59.55.log
+> test2-11-03-07_09.00.05.log
+> test2-11-03-07_09.59.55.log
+> test2-11-03-07_10.00.05.log
+> test2-11-03-07_10.59.55.log
+> test2-11-03-07_11.00.05.log
+> test2-11-03-07_11.59.55.log
+> test2-11-03-07_12.00.05.log
+> test2-11-03-07_12.59.55.log
+> test2.log
diff --git a/testing/btest/Baseline/logging.types/ssh.log b/testing/btest/Baseline/logging.types/ssh.log
index 19533265db..02e5b69579 100644
--- a/testing/btest/Baseline/logging.types/ssh.log
+++ b/testing/btest/Baseline/logging.types/ssh.log
@@ -1,2 +1,2 @@
 # b	i	e	c	p	sn	n	a	d	t	iv	s	sc	ss	se	vc	ve
-T	-42	SSH::SSH	21	123	10.0.0.0/24	10.0.0.0	1.2.3.4	3.14	1303438960.30366	100.0	hurz	1,4,2,3	CC,AA,BB	EMPTY	10,20,30	EMPTY
+T	-42	SSH::SSH	21	123	10.0.0.0/24	10.0.0.0	1.2.3.4	3.14	1304093423.61814	100.0	hurz	2,4,1,3	CC,AA,BB	EMPTY	10,20,30	EMPTY
diff --git a/testing/btest/Makefile b/testing/btest/Makefile
new file mode 100644
index 0000000000..ed042722b8
--- /dev/null
+++ b/testing/btest/Makefile
@@ -0,0 +1,14 @@
+
+all:
+    # Showing all tests.
+	@btest
+
+brief:
+    # Brief output showing only failed tests.
+	@btest -b
+
+brief-debug:
+    # Verbose output for failed tests, also recorded in test.log.
+	@rm -f test.log
+	@btest -b -d -f test.log
+	@echo Output in test.log
diff --git a/testing/btest/Scripts/diff-canonifier b/testing/btest/Scripts/diff-canonifier
index 2361355491..063f1e4900 100755
--- a/testing/btest/Scripts/diff-canonifier
+++ b/testing/btest/Scripts/diff-canonifier
@@ -2,4 +2,4 @@
 #
 # Replace anything which looks like timestamps with XXXs.
 
-sed 's/[0-9]\{10\}\.[0-9]\{4,6\}/XXXXXXXXXX.XXXXXX/g'
+sed 's/[0-9]\{10\}\.[0-9]\{2,8\}/XXXXXXXXXX.XXXXXX/g'
diff --git a/testing/btest/Scripts/diff-remove-abspath b/testing/btest/Scripts/diff-remove-abspath
new file mode 100755
index 0000000000..361ad3fa6d
--- /dev/null
+++ b/testing/btest/Scripts/diff-remove-abspath
@@ -0,0 +1,5 @@
+#! /usr/bin/env bash
+#
+# Replace absolute paths with the basename.
+
+sed 's#/\([^/]\{1,\}/\)\{1,\}\([^/]\{1,\}\)#<...>/\2#g'
diff --git a/testing/btest/Scripts/doc/example-diff-canonifier.py b/testing/btest/Scripts/doc/example-diff-canonifier.py
new file mode 100755
index 0000000000..e0b8c110cc
--- /dev/null
+++ b/testing/btest/Scripts/doc/example-diff-canonifier.py
@@ -0,0 +1,15 @@
+#!/usr/bin/python
+
+import sys
+import re
+
+# MutableVal derivatives (e.g. sets/tables) don't always generate the same
+# ordering in the reST documentation, so just don't bother diffing
+# the places where example.bro uses them.
+
+RE1 = "\d*/tcp"
+RE2 = "tcp port \d*"
+
+for line in sys.stdin.readlines():
+    if re.search(RE1, line) is None and re.search(RE2, line) is None:
+        print line
diff --git a/testing/btest/Traces/conn-size.trace b/testing/btest/Traces/conn-size.trace
new file mode 100644
index 0000000000..8b03d7a67f
Binary files /dev/null and b/testing/btest/Traces/conn-size.trace differ
diff --git a/testing/istate/traces/web.trace b/testing/btest/Traces/mixed-vlan-mpls.trace
similarity index 65%
rename from testing/istate/traces/web.trace
rename to testing/btest/Traces/mixed-vlan-mpls.trace
index 1651085190..ff9c68d5ed 100644
Binary files a/testing/istate/traces/web.trace and b/testing/btest/Traces/mixed-vlan-mpls.trace differ
diff --git a/testing/btest/analyzers/conn-size-cc.bro b/testing/btest/analyzers/conn-size-cc.bro
new file mode 100644
index 0000000000..0ba7977cf5
--- /dev/null
+++ b/testing/btest/analyzers/conn-size-cc.bro
@@ -0,0 +1,2 @@
+# @TEST-EXEC: bro -C -r ${TRACES}/conn-size.trace tcp udp icmp report_conn_size_analyzer=T
+# @TEST-EXEC: btest-diff conn.log
diff --git a/testing/btest/analyzers/conn-size.bro b/testing/btest/analyzers/conn-size.bro
new file mode 100644
index 0000000000..0e413cc554
--- /dev/null
+++ b/testing/btest/analyzers/conn-size.bro
@@ -0,0 +1,2 @@
+# @TEST-EXEC: bro -C -r ${TRACES}/conn-size.trace tcp udp icmp report_conn_size_analyzer=T use_connection_compressor=F
+# @TEST-EXEC: btest-diff conn.log
diff --git a/testing/btest/bifs/string_splitting.bro b/testing/btest/bifs/string_splitting.bro
index 1920db75a2..44068fe510 100644
--- a/testing/btest/bifs/string_splitting.bro
+++ b/testing/btest/bifs/string_splitting.bro
@@ -6,4 +6,7 @@ event bro_init()
 	{
 	local a = "X-Mailer: Testing Test (http://www.example.com)";
 	print split1(a, /:[[:blank:]]*/);
+
+	a = "A = B = C = D";
+	print split_all(a, /=/);
 	}
diff --git a/testing/btest/btest.cfg b/testing/btest/btest.cfg
index 43b53aca61..159e5a19e2 100644
--- a/testing/btest/btest.cfg
+++ b/testing/btest/btest.cfg
@@ -1,5 +1,5 @@
 [btest]
-TestDirs    = doc bifs logging language
+TestDirs    = doc bifs logging language core istate
 TmpDir      = %(testbase)s/.tmp
 BaselineDir = %(testbase)s/Baseline
 IgnoreDirs  = .svn CVS .tmp
@@ -9,9 +9,10 @@ IgnoreFiles = *.tmp *.swp #* *.trace
 BROPATH=`bash -c %(testbase)s/../../build/bro-path-dev`
 BRO_SEED_FILE=%(testbase)s/random.seed
 TZ=UTC
-LOCALE=C
+LC_ALL=C
 PATH=%(testbase)s/../../build/src:%(testbase)s/../../aux/btest:%(default_path)s
 TEST_DIFF_CANONIFIER=%(testbase)s/Scripts/diff-canonifier
 TRACES=%(testbase)s/Traces
+SCRIPTS=%(testbase)s/Scripts
 DIST=%(testbase)s/../..
 BUILD=%(testbase)s/../../build
diff --git a/testing/btest/core/conn-id.bro b/testing/btest/core/conn-id.bro
new file mode 100644
index 0000000000..04724bba3c
--- /dev/null
+++ b/testing/btest/core/conn-id.bro
@@ -0,0 +1,32 @@
+#
+# In "normal" test mode, connection uids should be determistic.
+#
+# @TEST-EXEC: bro -C -r $TRACES/wikipedia.trace %INPUT conn >output
+# @TEST-EXEC: btest-diff output
+#
+# Without a seed, they should differ each time:
+#
+# @TEST-EXEC: unset BRO_SEED_FILE &&  bro -C -r $TRACES/wikipedia.trace %INPUT tcp >output2
+# @TEST-EXEC: cat output output2 | sort | uniq -c | wc -l >counts
+# @TEST-EXEC: btest-diff counts
+#
+# Make sure it works without the connection compressor as well.
+#
+# @TEST-EXEC: bro -C -r $TRACES/wikipedia.trace %INPUT tcp use_connection_compressor=F >output.cc
+# @TEST-EXEC: btest-diff output.cc
+#
+# Make sure it works with the full connection compressor as well.
+#
+# @TEST-EXEC: bro -C -r $TRACES/wikipedia.trace %INPUT tcp cc_handle_only_syns=F >output.cc2
+# @TEST-EXEC: btest-diff output.cc2
+
+
+event new_connection(c: connection)
+	{
+	print c$id, c$uid;
+	}
+
+event connection_established(c: connection)
+	{
+	print c$id, c$uid;
+	}
diff --git a/testing/btest/core/print-bpf-filters-ipv4.bro b/testing/btest/core/print-bpf-filters-ipv4.bro
new file mode 100644
index 0000000000..5848972166
--- /dev/null
+++ b/testing/btest/core/print-bpf-filters-ipv4.bro
@@ -0,0 +1,9 @@
+# @TEST-REQUIRES: bro -e 'print bro_has_ipv6()' | grep -q F
+#
+# @TEST-EXEC: bro print-filter >output 2>&1
+# @TEST-EXEC: bro tcp print-filter >>output
+# @TEST-EXEC: bro tcp print-filter all_packets=F >>output
+# @TEST-EXEC: bro -f "port 42" print-filter >>output
+# @TEST-EXEC: bro -C -f "port 50343" -r $TRACES/mixed-vlan-mpls.trace tcp
+# @TEST-EXEC: btest-diff output
+# @TEST-EXEC: btest-diff conn.log
diff --git a/testing/btest/core/print-bpf-filters-ipv6.bro b/testing/btest/core/print-bpf-filters-ipv6.bro
new file mode 100644
index 0000000000..98bbc2db33
--- /dev/null
+++ b/testing/btest/core/print-bpf-filters-ipv6.bro
@@ -0,0 +1,9 @@
+# @TEST-REQUIRES: bro -e 'print bro_has_ipv6()' | grep -q T
+#
+# @TEST-EXEC: bro print-filter >output 2>&1
+# @TEST-EXEC: bro tcp print-filter >>output
+# @TEST-EXEC: bro tcp print-filter all_packets=F >>output
+# @TEST-EXEC: bro -f "port 42" print-filter >>output
+# @TEST-EXEC: bro -C -f "port 50343" -r $TRACES/mixed-vlan-mpls.trace tcp
+# @TEST-EXEC: btest-diff output
+# @TEST-EXEC: btest-diff conn.log
diff --git a/testing/btest/core/vlan-mpls.bro b/testing/btest/core/vlan-mpls.bro
new file mode 100644
index 0000000000..891f19d79a
--- /dev/null
+++ b/testing/btest/core/vlan-mpls.bro
@@ -0,0 +1,2 @@
+# @TEST-EXEC: bro -C -r $TRACES/mixed-vlan-mpls.trace tcp
+# @TEST-EXEC: btest-diff conn.log
diff --git a/testing/btest/doc/autogen-reST-all b/testing/btest/doc/autogen-reST-all
new file mode 100644
index 0000000000..d6326c7042
--- /dev/null
+++ b/testing/btest/doc/autogen-reST-all
@@ -0,0 +1 @@
+@TEST-EXEC: cd $BUILD && make restdoc
diff --git a/testing/btest/doc/autogen-reST-example b/testing/btest/doc/autogen-reST-example
index 7870259cad..ecd314eba6 100644
--- a/testing/btest/doc/autogen-reST-example
+++ b/testing/btest/doc/autogen-reST-example
@@ -1,2 +1,2 @@
-@TEST-EXEC: bro --doc-scripts $DIST/doc/example.bro
+@TEST-EXEC: bro --doc-scripts $DIST/doc/scripts/example.bro
 @TEST-EXEC: btest-diff example.rst
diff --git a/testing/btest/doc/autogen-reST-type-aliases.bro b/testing/btest/doc/autogen-reST-type-aliases.bro
index 20d75331f8..ce8986f8be 100644
--- a/testing/btest/doc/autogen-reST-type-aliases.bro
+++ b/testing/btest/doc/autogen-reST-type-aliases.bro
@@ -4,7 +4,7 @@
 ## This is just an alias for a builtin type ``bool``.
 type TypeAlias: bool;
 
-## We decided that creating alias "chains" might now be so useful to document
+## We decided that creating alias "chains" might not be so useful to document
 ## so this type just creates a cross reference to ``bool``.
 type OtherTypeAlias: TypeAlias;
 
diff --git a/testing/btest/doc/record-add.bro b/testing/btest/doc/record-add.bro
new file mode 100644
index 0000000000..a326314093
--- /dev/null
+++ b/testing/btest/doc/record-add.bro
@@ -0,0 +1,36 @@
+# @TEST-EXEC: bro --doc-scripts %INPUT
+
+# When in doc mode, bro will clone declared types (see add_type() in Var.cc)
+# in order to keep track of the identifier name associated with the new type.
+# This test makes sure that the cloning is done in a way that's compatible
+# with adding fields to a record type -- we want to be sure that cloning
+# a type that contains record types will correctly see field additions to
+# those contained-records.
+
+type my_record: record {
+    field1: bool;
+    field2: string;
+};
+
+type super_record: record {
+    rec: my_record;
+};
+type my_table: table[count] of my_record;
+type my_vector: vector of my_record;
+
+redef record my_record += {
+    field3: count &optional;
+};
+
+global a: my_record;
+global b: super_record;
+global c: my_table;
+global d: my_vector;
+
+function test_func()
+    {
+    a?$field3;
+    b$rec?$field3;
+    c[0]$field3;
+    d[0]$field3;
+    }
diff --git a/testing/btest/doc/record-attr-check.bro b/testing/btest/doc/record-attr-check.bro
new file mode 100644
index 0000000000..33ada44bfd
--- /dev/null
+++ b/testing/btest/doc/record-attr-check.bro
@@ -0,0 +1,9 @@
+# @TEST-EXEC: bro --doc-scripts %INPUT
+
+type Tag: enum {
+    SOMETHING
+};
+
+type R: record {
+    field1: set[Tag] &default=set();
+};
diff --git a/testing/btest/istate/broccoli.bro b/testing/btest/istate/broccoli.bro
index b4dd1aab31..ed6a9eee6a 100644
--- a/testing/btest/istate/broccoli.bro
+++ b/testing/btest/istate/broccoli.bro
@@ -5,7 +5,7 @@
 # @TEST-EXEC: btest-bg-run broccoli $BUILD/aux/broccoli/test/broping -r -c 3 127.0.0.1
 # @TEST-EXEC: btest-bg-wait -k 20
 # @TEST-EXEC: cat bro/ping.log | sed 's/one-way.*//g' >bro.log
-# @TEST-EXEC: cat broccoli/.stderr | sed 's/time=.*//g' >broccoli.log
+# @TEST-EXEC: cat broccoli/.stdout | sed 's/time=.*//g' >broccoli.log
 # @TEST-EXEC: btest-diff bro.log
 # @TEST-EXEC: btest-diff broccoli.log
 
diff --git a/testing/btest/istate/pybroccoli.py b/testing/btest/istate/pybroccoli.py
index 6fb19e196e..52aba6dfa1 100644
--- a/testing/btest/istate/pybroccoli.py
+++ b/testing/btest/istate/pybroccoli.py
@@ -5,8 +5,10 @@
 # @TEST-EXEC: btest-bg-run bro    bro %INPUT $DIST/aux/broccoli/bindings/broccoli-python/tests/test.bro
 # @TEST-EXEC: btest-bg-run python PYTHONPATH=$DIST/aux/broccoli/bindings/broccoli-python/:$BUILD/aux/broccoli/bindings/broccoli-python python $DIST/aux/broccoli/bindings/broccoli-python/tests/test.py
 # @TEST-EXEC: btest-bg-wait -k 20
-# @TEST-EXEC: btest-diff bro/.stdout.log
-# @TEST-EXEC: btest-diff broccoli/.stdout.log
+# @TEST-EXEC: btest-diff bro/.stdout
+#
+# @TEST-EXEC: sed 's/instance at [^>]*>/instance at >/' <python/.stdout >python/.stdout.filtered
+# @TEST-EXEC: btest-diff python/.stdout.filtered
 
 event remote_connection_closed(p: event_peer)
 	{
diff --git a/testing/btest/istate/sync.bro b/testing/btest/istate/sync.bro
index 04f3f69dcf..639c1b2dfe 100644
--- a/testing/btest/istate/sync.bro
+++ b/testing/btest/istate/sync.bro
@@ -39,13 +39,14 @@ type type2: record {
     b: type1;
     c: type1;
     d: double;
+    e: double &optional;
     };
 
 global foo17: type2 = [
 	$a = "yuyuyu",
 	$b = [$a="rec1", $b=100, $c=1.24],
 	$c = [$a="rec2", $b=200, $c=2.24],
-   	$d = 7.77				   
+	$d = 7.77, $e=100.0
 	] &persistent &synchronized;
 
 # Print variables.
@@ -113,9 +114,9 @@ function modify()
 	
 	foo15 = 6667/tcp;
 	
-	foo16[4] = 4;
-	foo16[2] = 20;
-	++foo16[1];
+	foo16[3] = 4;
+	foo16[1] = 20;
+	++foo16[0];
 	
 	local x: type1;
 	x$a = "pop";
@@ -127,6 +128,7 @@ function modify()
 	++foo17$c$b;
 	foo17$c$c = 612.2;
 	foo17$d = 6.6666;
+	delete foo17$e;
 	
 	foo2 = 1234567;
 }
diff --git a/testing/btest/language/cross-product-init.bro b/testing/btest/language/cross-product-init.bro
new file mode 100644
index 0000000000..c12f9eb0bd
--- /dev/null
+++ b/testing/btest/language/cross-product-init.bro
@@ -0,0 +1,10 @@
+# @TEST-EXEC: bro %INPUT  >output 2>&1
+# @TEST-EXEC: btest-diff output
+
+global my_subs = { 1.2.3.4/19, 5.6.7.8/21 };
+
+global x: set[string, subnet] &redef;
+
+redef x += { [["foo", "bar"], my_subs] };
+
+print x;
diff --git a/testing/btest/language/delete-field-set.bro b/testing/btest/language/delete-field-set.bro
new file mode 100644
index 0000000000..ad7cf6e9fb
--- /dev/null
+++ b/testing/btest/language/delete-field-set.bro
@@ -0,0 +1,16 @@
+# @TEST-EXEC: bro %INPUT >output 2>&1
+# @TEST-EXEC: btest-diff output
+
+type FooBar: record {
+        a: set[string] &default=set();
+        b: table[string] of count &default=table();
+        c: vector of string &default=vector();
+};
+
+global test: FooBar;
+
+delete test$a;
+delete test$b;
+delete test$c;
+
+print test;
diff --git a/testing/btest/language/delete-field.bro b/testing/btest/language/delete-field.bro
new file mode 100644
index 0000000000..477466b76a
--- /dev/null
+++ b/testing/btest/language/delete-field.bro
@@ -0,0 +1,20 @@
+# @TEST-EXEC: bro %INPUT >output 2>&1
+# @TEST-EXEC: btest-diff output
+
+type X: record {
+     a: count &optional;
+     b: count &default=5;
+};
+
+function p(x: X)
+	{
+	print x?$a ? fmt("a: %d", x$a) : "a: not set";
+	print x$b;
+	}
+
+
+global x: X = [$a=20, $b=20];
+p(x);
+delete x$a;
+delete x$b;
+p(x);
diff --git a/testing/btest/language/enum-scope.bro b/testing/btest/language/enum-scope.bro
new file mode 100644
index 0000000000..c8667bfada
--- /dev/null
+++ b/testing/btest/language/enum-scope.bro
@@ -0,0 +1,10 @@
+# @TEST-EXEC: bro %INPUT  >output 2>&1
+# @TEST-EXEC: btest-diff output
+
+type foo: enum { a, b } &redef;
+
+module test;
+
+redef enum foo += { c };
+
+print c;
diff --git a/testing/btest/language/match-test.bro b/testing/btest/language/match-test.bro
new file mode 100644
index 0000000000..9352d0f39f
--- /dev/null
+++ b/testing/btest/language/match-test.bro
@@ -0,0 +1,20 @@
+# @TEST-EXEC: bro %INPUT  >output 2>&1
+# @TEST-EXEC: btest-diff output
+
+global match_stuff = {
+	[$pred(a: count) = { return a > 5; },
+	 $result = "it's big",
+	 $priority = 2],
+
+	[$pred(a: count) = { return a > 15; },
+	 $result = "it's really big",
+	 $priority = 3],
+
+	[$pred(a: count) = { return T; },
+	 $result = "default",
+	 $priority = 0],
+};
+
+print match 0 using match_stuff;
+print match 10 using match_stuff;
+print match 20 using match_stuff;
diff --git a/testing/btest/language/match-test2.bro b/testing/btest/language/match-test2.bro
new file mode 100644
index 0000000000..f1c120adf2
--- /dev/null
+++ b/testing/btest/language/match-test2.bro
@@ -0,0 +1,51 @@
+# @TEST-EXEC: bro %INPUT  >output 2>&1
+# @TEST-EXEC: btest-diff output
+
+type fakealert : record {
+     alert: string;
+};
+
+
+type match_rec : record {
+     result : count;
+     pred : function(rec : fakealert) : bool;
+     priority: count;
+};
+
+
+#global test_set : set[int] = 
+#{
+#1, 2, 3
+#};
+
+global match_set : set[match_rec] = 
+{
+  [$result = 1, $pred(a: fakealert) = { return T; }, $priority = 8 ],
+  [$result = 2, $pred(a: fakealert) = { return T; }, $priority = 9 ]
+};
+
+global al : fakealert;
+
+#global testset : set[fakealert] = 
+#{
+#       [$alert="hithere"]
+#};
+
+
+type nonalert: record {
+     alert : string;
+     pred : function(a : int) : int;
+};
+
+#global na : nonalert;
+#na$alert = "5";
+
+#al$alert = "hithere2";
+#if (al in testset)
+#   print 1;
+#else
+#   print 0;
+
+
+al$alert = "hi";
+print (match al using match_set);
diff --git a/testing/btest/language/next-test.bro b/testing/btest/language/next-test.bro
new file mode 100644
index 0000000000..7e9626a62c
--- /dev/null
+++ b/testing/btest/language/next-test.bro
@@ -0,0 +1,36 @@
+# @TEST-EXEC: bro %INPUT  >output 2>&1
+# @TEST-EXEC: btest-diff output
+
+# This script tests "next" being called during the last iteration of a
+# for loop
+
+event bro_done()
+  {
+
+        local number_set: set[count];
+        local i: count;
+
+        add number_set[0];
+        add number_set[1];
+
+
+        for ( i in number_set )
+                {
+                print fmt ("%d", i);
+                if ( i == 0 )
+                        next;
+                print fmt ("%d", i);
+                }
+        print fmt ("MIDDLE");
+
+
+        for ( i in number_set )
+                {
+                print fmt ("%d", i);
+                if ( i == 1 )
+                        next;
+                print fmt ("%d", i);
+                }
+        print fmt ("THE END");
+
+        }
diff --git a/testing/btest/language/rare-events.bro b/testing/btest/language/rare-events.bro
new file mode 100644
index 0000000000..ae7674d406
--- /dev/null
+++ b/testing/btest/language/rare-events.bro
@@ -0,0 +1,37 @@
+# @TEST-EXEC: bro %INPUT  >output 2>&1
+# @TEST-EXEC: btest-diff output
+
+# This is a test script whose job is to generate rarely-seen events
+# (i.e., events that test traces might not include) to ensure that they're
+# handled properly.
+
+# This is needed or else the output fails on the warning that
+# Drop::restore_dropped_address is never defined.
+redef check_for_unused_event_handlers = F;
+
+@load netstats
+
+function test_net_stats_update()
+    {
+    local t = current_time();
+
+    local s: net_stats;
+    s$pkts_recvd = 1234;
+    s$pkts_dropped = 123;
+    s$pkts_link = 9999;
+
+    event net_stats_update(t, s);
+
+    local s2: net_stats;
+    s2$pkts_recvd = 2341;
+    s2$pkts_dropped = 125;
+    s2$pkts_link = 19999;
+
+    event net_stats_update(t + 33 sec, s2);
+    }
+
+event bro_init()
+    {
+    test_net_stats_update();
+    }
+
diff --git a/testing/btest/language/rec-comp-init.bro b/testing/btest/language/rec-comp-init.bro
new file mode 100644
index 0000000000..598c0cf3bd
--- /dev/null
+++ b/testing/btest/language/rec-comp-init.bro
@@ -0,0 +1,14 @@
+# @TEST-EXEC: bro %INPUT  >output 2>&1
+# @TEST-EXEC: btest-diff output
+
+# Make sure composit types in records are initialized.
+
+type Foo: record {
+	a: set[count];
+	b: table[count] of string;
+	c: vector of string;
+};
+
+global f: Foo;
+
+print f;
diff --git a/testing/btest/language/rec-nested-opt.bro b/testing/btest/language/rec-nested-opt.bro
index eb7375541b..ab1a64dffd 100644
--- a/testing/btest/language/rec-nested-opt.bro
+++ b/testing/btest/language/rec-nested-opt.bro
@@ -1,4 +1,3 @@
-
 # @TEST-EXEC: bro %INPUT >output 2>&1
 # @TEST-EXEC: btest-diff output
 
diff --git a/testing/btest/language/rec-of-tbl.bro b/testing/btest/language/rec-of-tbl.bro
new file mode 100644
index 0000000000..59d770bb30
--- /dev/null
+++ b/testing/btest/language/rec-of-tbl.bro
@@ -0,0 +1,16 @@
+# @TEST-EXEC: bro %INPUT  >output 2>&1
+# @TEST-EXEC: btest-diff output
+
+type x: record {
+	a: table[int] of count;
+};
+
+global y: x;
+
+global yy: table[int] of count;
+
+y$a = yy;
+
+y$a[+5] = 3;
+
+print y;
diff --git a/testing/btest/language/rec-table-default.bro b/testing/btest/language/rec-table-default.bro
index 1473933e6a..ee4a0e25ee 100644
--- a/testing/btest/language/rec-table-default.bro
+++ b/testing/btest/language/rec-table-default.bro
@@ -1,4 +1,3 @@
-
 # @TEST-EXEC: bro %INPUT >output 2>&1
 # @TEST-EXEC: btest-diff output
 
diff --git a/testing/btest/language/record-recursive-coercion.bro b/testing/btest/language/record-recursive-coercion.bro
new file mode 100644
index 0000000000..eda80e3d11
--- /dev/null
+++ b/testing/btest/language/record-recursive-coercion.bro
@@ -0,0 +1,24 @@
+# @TEST-EXEC: bro %INPUT >output 2>&1
+# @TEST-EXEC: btest-diff output
+
+type Version: record {
+        major:  count  &optional;
+        minor:  count  &optional;
+        minor2: count  &optional;
+        addl:   string &optional;
+};
+
+type Info: record {
+        name:    string;
+        version: Version;
+};
+
+global matched_software: table[string] of Info = {
+        ["OpenSSH_4.4"] = [$name="OpenSSH", $version=[$major=4,$minor=4]],
+};
+
+event bro_init()
+        {
+        for ( sw in matched_software )
+                print matched_software[sw]$version;
+        }
diff --git a/testing/btest/language/sizeof.bro b/testing/btest/language/sizeof.bro
new file mode 100644
index 0000000000..7db78212ad
--- /dev/null
+++ b/testing/btest/language/sizeof.bro
@@ -0,0 +1,119 @@
+# @TEST-EXEC: bro %INPUT  >output 2>&1
+# @TEST-EXEC: btest-diff output
+
+# Demo policy for the sizeof operator "|x|".
+# ------------------------------------------
+#
+# This script creates various types and values and shows the result of the
+# sizeof operator on these values.
+#
+# For any types not covered in this script, the sizeof operator's semantics
+# are not defined and its application returns a count of 0. At the moment
+# the only type where this should happen is string patterns.
+
+type example_enum: enum { ENUM1, ENUM2, ENUM3 };
+
+type example_record: record {
+	i: int &optional;
+	j: int &optional;
+	k: int &optional;
+};
+
+global a:  addr = 1.2.3.4;
+global b:  bool = T;
+global c:  count = 10;
+global d:  double = -1.23;
+global f:  file = open_log_file("sizeof_demo");
+global i:  int = -10;
+global iv: interval = -5sec;
+global n:  net = 192.168.;
+global p:  port = 80/tcp;
+global r:  example_record [ $i = 10 ];
+global si: set[int];
+global s:  string = "Hello";
+global sn: subnet = 192.168.0.0/24;
+global t:  table[string] of string;
+global ti: time = current_time();
+global v:  vector of string;
+
+# Additional initialization
+#
+print f, "12345678901234567890";
+
+add si[1];
+add si[10];
+add si[100];
+
+t["foo"] = "Hello";
+t["bar"] = "World";
+
+v[0] = "Hello";
+v[4] = "World";
+
+# Print out the sizes of the various vals:
+#-----------------------------------------
+
+# Size of addr: returns integer representation for IPv4, 0 for IPv6.
+print fmt("Address %s: %d", a, |a|);
+
+# Size of boolean: returns 1 or 0.
+print fmt("Boolean %s: %d", b, |b|);
+
+# Size of count: identity.
+print fmt("Count %s: %d", c, |c|);
+
+# Size of double: returns absolute value.
+print fmt("Double %s: %f", d, |d|);
+
+# Size of enum: returns numeric value of enum constant.
+print fmt("Enum %s: %d", ENUM3, |ENUM3|);
+
+# Size of file: returns current file size.
+# Note that this is a double so that file sizes >> 4GB
+# can be expressed.
+print fmt("File %f", |f|);
+
+# Size of function: returns number of arguments.
+print fmt("Function add_interface: %d", |add_interface|);
+
+# Size of integer: returns absolute value.
+print fmt("Integer %s: %d", i, |i|);
+
+# Size of interval: returns double representation of the interval
+print fmt("Interval %s: %f", iv, |iv|);
+
+# Size of net: returns size of class N network as a double
+# (so that 2^32 can be expressed too).
+print fmt("Net %s: %f", n, |n|);
+
+# Size of port: returns port number as a count.
+print fmt("Port %s: %d", p, |p|);
+
+# Size of record: returns number of fields (assigned + unassigned)
+print fmt("Record %s: %d", r, |r|);
+
+# Size of set: returns number of elements in set.
+# Don't print the set, as its order depends on the seeding of the hash
+# fnction, and it's not worth the trouble to normalize it.
+print fmt("Set: %d", |si|);
+
+# Size of string: returns string length.
+print fmt("String '%s': %d", s, |s|);
+
+# Size of subnet: returns size of net as a double 
+# (so that 2^32 can be expressed too).
+print fmt("Subnet %s: %f", sn, |sn|);
+
+# Size of table: returns number of elements in table
+print fmt("Table %d", |t|);
+
+# Size of time: returns double representation of the time
+# print fmt("Time %s: %f", ti, |ti|);
+
+# Size of vector: returns largest assigned index.
+# Note that this is not the number of assigned values.
+# The following prints "5":
+#
+print fmt("Vector %s: %d", v, |v|);
+
+close(f);
diff --git a/testing/btest/language/smith-waterman-test.bro b/testing/btest/language/smith-waterman-test.bro
new file mode 100644
index 0000000000..50f5c1dae1
--- /dev/null
+++ b/testing/btest/language/smith-waterman-test.bro
@@ -0,0 +1,88 @@
+# @TEST-EXEC: bro %INPUT  >output 2>&1
+# @TEST-EXEC: btest-diff output
+
+global params: sw_params = [ $min_strlen = 2, $sw_variant = 0 ];
+
+global min: vector of count;
+global mode: vector of count;
+global c: count = 0;
+
+# Alignment pairs:
+global s1: string_vec;
+global s2: string_vec;
+
+# Single alignment, no matches:
+s1[++c] = "abcdefgh";
+s2[c] = "ijklmnop";
+min[c] = 2;;
+mode[c] = 0;
+
+# Simple single match, beginning:
+s1[++c] = "AAAabcefghij";
+s2[c] = "lmnopAAAqrst";
+min[c] = 2;;
+mode[c] = 0;
+
+# Simple single match, middle:
+s1[++c] = "abcAAAefghij";
+s2[c] = "lmnopAAAqrst";
+min[c] = 2;;
+mode[c] = 0;
+
+# Simple single match, end:
+s1[++c] = "abcefghijAAA";
+s2[c] = "lmnopAAAqrst";
+min[c] = 2;;
+mode[c] = 0;
+
+# Repeated alignment:
+s1[++c] = "xxxAAAyyy";
+s2[c] = "AAAaAAAbAAA";
+min[c] = 2;;
+mode[c] = 1;
+
+# Repeated alignment, swapped input:
+s1[++c] = "AAAaAAAbAAA";
+s2[c] = "xxxAAAyyy";
+min[c] = 2;;
+mode[c] = 1;
+
+# Repeated alignment, split:
+s1[++c] = "xxCDyABzCDyABzz";
+s2[c] = "ABCD";
+min[c] = 2;;
+mode[c] = 1;
+
+# Repeated alignment, split, swapped:
+s1[++c] = "ABCD";
+s2[c] = "xxCDyABzCDyABzz";
+min[c] = 2;;
+mode[c] = 1;
+
+# Used to cause problems
+s1[++c] = "Cache-control: no-cache^M^JAccept:";
+s2[c] = "Accept-: deflate^M^JAccept-: Accept-";
+min[c] = 6;
+mode[c] = 1;
+
+# Repeated occurrences in shorter string
+s1[++c] = "xxAAxxAAxx";
+s2[c]   = "yyyyyAAyyyyy";
+min[c] = 2;
+mode[c] = 1;
+
+for ( i in s1 )
+	{
+	local ss: sw_substring_vec;
+
+	params$min_strlen = min[i];
+	params$sw_variant = mode[i];
+	ss = str_smith_waterman(s1[i], s2[i], params);
+
+	print fmt("%s - %s:", s1[i], s2[i]);
+
+	for ( j in ss )
+		print fmt("tok %d: %s (%d/%d, %s)",
+				j, ss[j]$str, ss[j]$aligns[1]$index,
+				ss[j]$aligns[2]$index, ss[j]$new);
+	}
diff --git a/testing/btest/language/strings.bro b/testing/btest/language/strings.bro
new file mode 100644
index 0000000000..8e9eef43bf
--- /dev/null
+++ b/testing/btest/language/strings.bro
@@ -0,0 +1,48 @@
+# @TEST-EXEC: bro %INPUT  >output 2>&1
+# @TEST-EXEC: btest-diff output
+
+# Demo policy for string functions
+#
+
+event bro_init()
+{
+	local s1: string = "broisaveryneatids";
+
+	print fmt("Input string: %s", s1);
+	print fmt();
+	print fmt("String splitting");
+	print fmt("----------------");
+
+	local idx1: index_vec;
+
+	idx1[0] =  0; # We really need initializers for vectors ...
+	idx1[1] =  3;
+	idx1[2] =  5;
+	idx1[3] =  6;
+	idx1[4] = 10;
+	idx1[5] = 14;
+
+	print fmt("Splitting '%s' at %d points...", s1, |idx1|);
+	local res_split: string_vec = str_split(s1, idx1);
+
+	for ( i in res_split )
+		print res_split[i];
+
+	print fmt();
+	print fmt("Substrings");
+	print fmt("----------");
+	print fmt("3@0: %s", sub_bytes(s1, 0, 3));
+	print fmt("5@2: %s", sub_bytes(s1, 2, 5));
+	print fmt("7@4: %s", sub_bytes(s1, 4, 7));
+	print fmt("10@10: %s", sub_bytes(s1, 10, 10));
+	print fmt();
+
+
+	print fmt("Finding strings");
+	print fmt("---------------");
+	print fmt("isa: %d", strstr(s1, "isa"));
+	print fmt("very: %d", strstr(s1, "very"));
+	print fmt("ids: %d", strstr(s1, "ids"));
+	print fmt("nono: %d", strstr(s1, "nono"));
+}
+
diff --git a/testing/btest/language/wrong-delete-field.bro b/testing/btest/language/wrong-delete-field.bro
new file mode 100644
index 0000000000..0b58cc6fa0
--- /dev/null
+++ b/testing/btest/language/wrong-delete-field.bro
@@ -0,0 +1,10 @@
+# @TEST-EXEC-FAIL: bro %INPUT  >output 2>&1
+# @TEST-EXEC: btest-diff output
+
+type X: record {
+     a: count;
+};
+
+global x: X = [$a=20];
+
+delete x$a;
diff --git a/testing/btest/logging/rotate-custom.bro b/testing/btest/logging/rotate-custom.bro
index 66e90de8c3..59ad1330cd 100644
--- a/testing/btest/logging/rotate-custom.bro
+++ b/testing/btest/logging/rotate-custom.bro
@@ -1,6 +1,6 @@
 #
 # @TEST-EXEC: bro -r %DIR/rotation.trace %INPUT >out
-# @TEST-EXEC: for i in `ls test*.log | sort`; do printf '> %s\n' $i; cat $i; done >>out
+# @TEST-EXEC: for i in `ls test*.log | sort`; do printf '> %s\n' $i; cat $i; done | sort | uniq >>out
 # @TEST-EXEC: btest-diff out
 
 module Test;
diff --git a/testing/btest/logging/vec.bro b/testing/btest/logging/vec.bro
index 8d882d53bb..b9ed8f8d6d 100644
--- a/testing/btest/logging/vec.bro
+++ b/testing/btest/logging/vec.bro
@@ -18,8 +18,8 @@ event bro_init()
 
     local v: vector of string;
 
-	v[2] = "2";
-	v[5] = "5";
+	v[1] = "2";
+	v[4] = "5";
 
 	Log::write(SSH, [$vec=v]);
 }
diff --git a/testing/istate/README b/testing/istate/README
deleted file mode 100644
index 78e855074f..0000000000
--- a/testing/istate/README
+++ /dev/null
@@ -1,11 +0,0 @@
-To run these tests, invoke:
-
-	./istate.py
-
-To see differences leading to test failures, invoke:
-
-	./istate.py -s
-
-Build a new test baseline using:
-
-	./istate.py -b
diff --git a/testing/istate/base/bro-ping/remote.log b/testing/istate/base/bro-ping/remote.log
deleted file mode 100644
index 4f86bd62d6..0000000000
--- a/testing/istate/base/bro-ping/remote.log
+++ /dev/null
@@ -1,17 +0,0 @@
-xxxxxxxxxx.xxxxxx [info]  [parent] pipe's socket buffer size is 8192, setting to 1048576
-xxxxxxxxxx.xxxxxx [info]  [parent] communication started, parent 
-xxxxxxxxxx.xxxxxx [info]  [child]  listening on 0.0.0.0:47758 (clear)
-xxxxxxxxxx.xxxxxx [info]  [child]  [#10000/] accepted clear connection
-xxxxxxxxxx.xxxxxx [info]  [parent] [#10000/] added peer
-xxxxxxxxxx.xxxxxx [info]  [parent] [#10000/] peer connected
-xxxxxxxxxx.xxxxxx [info]  [parent] [#10000/] phase: version
-xxxxxxxxxx.xxxxxx [info]  [script] [#10000/] connection established
-xxxxxxxxxx.xxxxxx [info]  [script] [#10000/] requesting events matching /^?(ping)$?/
-xxxxxxxxxx.xxxxxx [info]  [script] [#10000/] accepting state
-xxxxxxxxxx.xxxxxx [info]  [script] [#10000/] requesting synchronized state
-xxxxxxxxxx.xxxxxx [info]  [parent] [#10000/] phase: handshake
-xxxxxxxxxx.xxxxxx [info]  [parent] [#10000/] registered for event pong
-xxxxxxxxxx.xxxxxx [info]  [parent] [#10000/] peer does not support 64bit PIDs; using compatibility mode
-xxxxxxxxxx.xxxxxx [info]  [parent] [#10000/] phase: sync (receiver)
-xxxxxxxxxx.xxxxxx [info]  [parent] [#10000/] phase: running
-xxxxxxxxxx.xxxxxx [info]  [parent] [#10000/] closing connection
diff --git a/testing/istate/base/bro-ping/stderr.log b/testing/istate/base/bro-ping/stderr.log
deleted file mode 100644
index bb611b7eb0..0000000000
--- a/testing/istate/base/bro-ping/stderr.log
+++ /dev/null
@@ -1,3 +0,0 @@
-xxxxxxxxxx.xxxxxx processing suspended
-xxxxxxxxxx.xxxxxx processing continued
-xxxxxxxxxx.xxxxxx received termination signal
diff --git a/testing/istate/base/bro-ping/stdout.log b/testing/istate/base/bro-ping/stdout.log
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/testing/istate/base/broccoli-ping/stderr.log b/testing/istate/base/broccoli-ping/stderr.log
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/testing/istate/base/broccoli-ping/stdout.log b/testing/istate/base/broccoli-ping/stdout.log
deleted file mode 100644
index 6174e6cce8..0000000000
--- a/testing/istate/base/broccoli-ping/stdout.log
+++ /dev/null
@@ -1,5 +0,0 @@
-pong event from 127.0.0.1: seq=0, 
-pong event from 127.0.0.1: seq=1, 
-pong event from 127.0.0.1: seq=2, 
-pong event from 127.0.0.1: seq=3, 
-pong event from 127.0.0.1: seq=4, 
diff --git a/testing/istate/base/events-display/stdout.log b/testing/istate/base/events-display/stdout.log
deleted file mode 100644
index a68f969a3c..0000000000
--- a/testing/istate/base/events-display/stdout.log
+++ /dev/null
@@ -1,36 +0,0 @@
-Event [xxxxxxxxxx.xxxxxx] bro_done()
-Event [xxxxxxxxxx.xxxxxx] connection_established([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=0, state=4], resp=[size=0, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.182510137557983, service={}, addl="", hot=0, history="Sh"])
-Event [xxxxxxxxxx.xxxxxx] connection_finished([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=5], resp=[size=9417, state=5], start_time=xxxxxxxxxx.xxxxxx, duration=1.73330307006836, service={}, addl="%events-send-1", hot=0, history="ShADdFaf"])
-Event [xxxxxxxxxx.xxxxxx] connection_pending([id=[orig_h=141.42.64.125, orig_p=56729/tcp, resp_h=125.190.109.199, resp_p=12345/tcp], orig=[size=0, state=1], resp=[size=0, state=6], start_time=xxxxxxxxxx.xxxxxx, duration=0.182432889938354, service={}, addl="", hot=0, history="Sr"])
-Event [xxxxxxxxxx.xxxxxx] connection_state_remove([id=[orig_h=141.42.64.125, orig_p=56729/tcp, resp_h=125.190.109.199, resp_p=12345/tcp], orig=[size=0, state=1], resp=[size=0, state=6], start_time=xxxxxxxxxx.xxxxxx, duration=0.182432889938354, service={}, addl="", hot=0, history="Sr"])
-Event [xxxxxxxxxx.xxxxxx] connection_state_remove([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=5], resp=[size=9417, state=5], start_time=xxxxxxxxxx.xxxxxx, duration=1.73330307006836, service={}, addl="%events-send-1", hot=0, history="ShADdFaf"])
-Event [xxxxxxxxxx.xxxxxx] http_begin_entity([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=0, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.183290958404541, service={}, addl="%events-send-1", hot=0, history="ShAD"]T)
-Event [xxxxxxxxxx.xxxxxx] http_begin_entity([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=1448, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.367331027984619, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShADd"]F)
-Event [xxxxxxxxxx.xxxxxx] http_content_type([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=0, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.183290958404541, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShAD"]T"TEXT""PLAIN")
-Event [xxxxxxxxxx.xxxxxx] http_content_type([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=1448, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.367331027984619, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShADd"]F"TEXT""HTML")
-Event [xxxxxxxxxx.xxxxxx] http_end_entity([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=0, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.183290958404541, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShAD"]T)
-Event [xxxxxxxxxx.xxxxxx] http_end_entity([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=9417, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.73563814163208, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShADd"]F)
-Event [xxxxxxxxxx.xxxxxx] http_entity_data([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=5792, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.551820039749146, service={}, addl="%events-send-1", hot=0, history="ShADd"]F4096"<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"^J"http://www.w3.org/TR/REC-html40/loose.dtd">^J<HEAD><TITLE>ICIR</TITLE></HEAD>^J<BODY bgcolor="#ffffff" text="#000000" link="#0000ff" vlink="#b20000">^J<img src=icir.gif alt="ICIR"><br>^J<p>^JICIR (The ICSI Center for Internet Research)^Jis a ^Jnon-profit^Jresearch institute at^J<a href="http://www.icsi.berkeley.edu">ICSI</a>^Jin ^J<a href="http://dir.yahoo.com/Regional/U_S__States/California/Cities/Berkeley/">Berkeley</a>, ^JCalifornia.<br>^JFor the three years from 1999 to 2001 we were named^JACIRI, the AT&T Center for Internet Research at ICSI, ^Jand were funded by <a href="http://www.att.com">AT&amp;T</a>.<br>^J^JThe goals of ICIR are to:^J<ul>^J<li>Pursue research on the Internet architecture and related networking issues,^J<li>^JParticipate actively in the research (<a href="http://www.acm.org/sigcomm/">SIGCOMM</a> and <a href="http://www.irtf.org/">IRTF</a>) and^Jstandards (<a href="http://www.ietf.org/">IETF</a>) communities,^J<li> Bridge the gap between the Internet research community and commercial ^Jinterests by providing a neutral forum where topics of mutual technical ^Jinterest can be addressed.^J</ul>^J<p>^J<!--^JICIR is now ^J<a href="jobs.html">^Jhiring</a> for both postdoctoral positions and summer interns.^J-->^J<hr>^J^J<DIV ALIGN="CENTER">^J^J<table width="100%" cellspacing=16 cellpadding=0>^J^J<tr>^J<td width="35%" valign=top>^J^J<h2>^JPeople^J</h2>^J<ul>^J<li>^J<a href="./shenker/">^JScott Shenker</a>, Group Leader<br> ^J<li><a href="http://www.icir.org/mallman/">Mark Allman</a>^J<li>^J<a href="./floyd/">Sally Floyd</a>^J<!--^J<li><a href="http://www.isi.edu/~govindan/">Ramesh Govindan</a>^J-->^J<li>^J<a href="./karp/papers.html">^JRichard Karp</a>  ^J<!-- (also with the ^J<a href="http://www.icsi.berkeley.edu/Theory/">ICSI Theory Group</a>, ^J<a href="http://www.msri.org/">MSRI</a>, and^J<a href="http://www.cs.berkeley.edu/">UC Berkeley</a>) -->^J<li>^J<a href="./vern/">^JVern Paxson</a>  ^J<li>^J<a href="http://www.icir.org/robin/">^JRobin Sommer</a>^J<li>^J<a href="http://www.cs.berkeley.edu/~nweaver/">^JNicholas Weaver</a>^J<li>^J<a href="http://www.icsi.berkeley.edu/~zhao/">^JJerry Zhao</a>^J<!-- </ul> &nbsp; &nbsp;<b>Group Members</b> <ul> -->^J<li><b><a href="pastvisitors.html">Past Group Members</a></b>,^J<br>including:^J<ul>^J<li>^J<a href="http://www.cs.ucl.ac.uk/staff/M.Handley/">^JMark Handley</a> (UCL)^J<li><a href="./kohler/">Eddie Kohler</a> (UCLA)^J</ul>^J<li><b>Affiliated <a href="http://www.xorp.org/">Xorp</a>^JResearchers</b>:^J  <ul>^J  <li><a href="./jcardona/">Javier Cardona</a>^J  <li><a href="./atanu/">Atanu Ghosh</a> ^J  <li><a href="./hodson/">Orion Hodson</a>^J  <li><a href="./pavlin/">Pavlin Radoslavov</a> ^J  <li><a href="http://www.iet.unipi.it/~luigi">Luigi Rizzo</a>^J  <li><a href="http://people.freebsd.org/~bms/">Bruce Simpson</a>^J</ul>^J<li><b>Affiliated UCB Researchers</b>:^J  <ul>^J  <li><a href="http://www.cs.berkeley.edu/~christos/">Christos Papadimitriou</a>^J  <li><a href="http://www.cs.berkeley.edu/~istoica/">Ion Stoica</a>^J  </ul>^J<li><b>Visitors</b>:^J  <ul>^J  <li><a href="http://grid.sjtu.edu.cn/teachers/dengqn/dengqn.htm">Professor Quin-Ni Deng</a>^J<!--^J  from Shanghai Jiaotong University^J-->^J  <li>Teemu Koponen^J<!--^J  , Helsinki Institute for Information Technology^J-->^J  </ul>^J<!--^J<li><a href="pastvisitors.html">Other researchers</a>^J-->^J<a name=Visitors></a>^J<li><b>Interns:</b>^J<ul>^J<li>Juan Caballero^J<li><a href="http://www.stanford.edu/~casado/">Martin Casado</a>^J<li><a href="http://www.cs.rice.edu/~scrosby/">Scott Crosby</a>^J<li><a href="http://bnrg.cs.berkeley.edu/~wdc/">Weidong Cui</a>^J<li><a href="http://www.cs.berkeley.edu/~chema">Chema Gonzalez</a>^J<li>Halldor Isak Gylfason^J<li><a href="http://www.cl.cam.ac.uk/~cpk25/">Christian Kreibich</a>^J<li><a href="http://www.cs.ucsd.edu/~braghava">Barath Raghavan</a>^J<!--^J<li><a href="newinterns.html">New Interns:</a> ^J-->^J</ul>^J<li><b>Undergraduate Interns:</b>^J<ul>^J<li>Michael Hoisie^J<li>Arthur Wayne Liao^J<li>Christopher Portka^J</ul>^J<li><b><a href="pastvisitors.html">Past Visitors and Interns:</a></b>^J</ul>^J^J</td>^J<td width="30%" vali")
-Event [xxxxxxxxxx.xxxxxx] http_entity_data([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=8688, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.552114009857178, service={}, addl="%events-send-1", hot=0, history="ShADd"]F4096"gn=top>^J^J<h2>^JPublications^J</h2>^J<ul>^J<li><a href="./rfcs.html">^JRFCs</a> with ICIR authors.^J<li>^J<a href="./internetdrafts.html">^JInternet drafts</a> with ICIR authors, 3/2004 ^J(or <a href="http://www.rfc-editor.org/idsearch.html">search</a>^Jthe current list).^J<!--^Jfor "Shenker OR Floyd OR Allman OR Paxson".^J(or the ^J<a^Jhref="^Jhttp://search.ietf.org:80/search/cgi-bin/BrokerQuery.pl.cgi?broker=internet-drafts&query=%28Author%3A+Shenker+OR+Floyd+OR+Handley+OR+Paxson+OR+Kohler%29&caseflag=on&wordflag=off&errorflag=0&maxlineflag=50&maxresultflag=1000&descflag=on&sort=by-NML&verbose=on&maxobjflag=25">current list</a>.)^J^Jhttp://search.ietf.org:80/search/cgi-bin/BrokerQuery.pl.cgi?broker=internet-drafts&query=(Shenker+OR+Floyd+OR+Handley+OR+Paxson+OR+Kohler)&descflag=on">current list</a>).^J-->^J<!--^Jfrom the ^J<a href="http://search.ietf.org/search/brokers/internet-drafts/query.html">^JInternet-Drafts Search Engine</a>).^J-->^J<li>Papers by ^J<a href="./shenker/papers.html">Scott Shenker</a>^J(<a^Jhref="http://citeseer.ist.psu.edu/cs?qb=dbnum%3D1%2Cqtype%3Dcitation:&q=Scott%20w/2%20Shenker%20or%20S%20w/2%20Shenker&co=Citations">RI</a>),^J^J<a href="./mallman/papers/">Mark Allman</a>^J(<a^Jhref="http://citeseer.ist.psu.edu/cs?qb=dbnum%3D1%2Cqtype%3Dcitation:&q=Mark%20w/2%20Allman%20or%20S%20w/2%20Allman&co=Citations">RI</a>),^J^J<a href="./floyd/papers.html">Sally Floyd</a>^J(<a^Jhref="http://citeseer.ist.psu.edu/cs?qb=dbnum%3D1%2Cqtype%3Dcitation:&q=Sally%20w/2%20Floyd%20or%20S%20w/2%20Floyd&co=Citations">RI</a>),^J^J<a href="./karp/papers.html">Richard Karp</a>^J(<a^Jhref="http://citeseer.ist.psu.edu/cs?qb=dbnum%3D1%2Cqtype%3Dcitation:&q=Richard%20w/2%20Karp%20or%20R%20w/2%20Karp&co=Citations">RI</a>),^J<a href="./kohler/pubs/">Eddie Kohler</a>^J(<a^Jhref="http://citeseer.ist.psu.edu/cs?qb=dbnum%3D1%2Cqtype%3Dcitation:&q=eddie%20w/2%20kohler%20or%20e%20w/2%20kohler&co=Citations">RI</a>),^J<a href="./vern/papers.html">Vern Paxson</a>^J(<a^Jhref="http://citeseer.ist.psu.edu/cs?qb=dbnum%3D1%2Cqtype%3Dcitation:&q=Vern%20w/2%20Paxson%20or%20V%20w/2%20Paxson&co=Citations">RI</a>).^J<li>The <a href="http://citeseer.ist.psu.edu/">^JResearchIndex</a> (RI) and the ^J<a href="http://citeseer.ist.psu.edu/cs">Search</a>^Jand ^J<a href="http://citeseer.ist.psu.edu/Networking/">^JNetworking</a> pages. ^J</ul>^J^J<h2>^JProjects ^J</h2>^J<ul>^J<li>^J<a href="./vern/bro-info.html">Bro</a>^J(detecting network intruders). ^J<li>The <a href="http://www.isi.edu/newarch/">NewArch</a> Project:^JFuture-Generation Internet Architecture.^J<LI>The <a href="http://www.isi.edu/nsnam/ns/">NS</a>^Jnetwork simulator.^J<li> <a href="./tbit/">TBIT</a>^J(TCP Behavior Identification Tool).^J<li> <a href="http://www.xorp.org/">Xorp</a>^J(Extensible Open Router Platform).^J<li>^J<a href="./funded_projects.html">^JOther Funded Projects</a>.^J<li>^J<a href="./research.html">^JAdditional Research Links</a>.^J</ul>^J^J^J</td>^J^J<td width="35%" valign=top>^J    ^J<h2>Research</h2>^J&nbsp; &nbsp;<b>Transport and Congestion</b>^J<ul>^J<li>^J<a href="./kohler/dcp/">DCCP</a>^J(Datagram Congestion Control Protocol).^J<li>^J<a href="./floyd/ecn.html">ECN</a>^J(Explicit Congestion Notification).^J<li>^J<a href="http://www.ietf.org/html.charters/intserv-charter.html">^JIntegrated services</a>.^J<li>^J<a href="./floyd/red.html">RED</a> ^Jqueue management, and^J<a href="./red-pd/">RED-PD</a>.^J<li>^J<a href="./floyd/hstcp.html">HighSpeed TCP</a>.^J<li>^J<a^Jhref="http://www.ietf.cnri.reston.va.us/html.charters/OLD/tcpimpl-charter.html">^JTCP Implementation</a>.^J<li>^JReordering-Robust TCP ^J(<a href="./bkarp/RR-TCP/">RR-TCP</a>).^J<li>TCP^J<a href="./floyd/sacks.html">SACK</a> ^J(Selective Acknowledgment).^J<li>^J<a href="./tfrc/">TFRC</a> ^J(TCP-Friendly Rate Control).^J</ul>^J^J&nbsp; &nbsp;<b>Traffic and Topology</b>^J<ul>^J<LI>^J<a href="http://idmaps.eecs.umich.edu/">IDMaps</a> ^J(Internet Distance Mapping).^J<LI>The <a href="http://www.acm.org/sigcomm/ITA/">^JInternet Traffic Archive</a>.^J<li>^J<a href="http://www-net.cs.umass.edu/minc/">MINC</a>^J(Multicast-based Inference of Network-internal Characteristics).^J<li>^J<a href="http://www.psc.edu/networking/nimi/">NIMI</a>^J(N")
-Event [xxxxxxxxxx.xxxxxx] http_entity_data([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=9417, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.73563814163208, service={}, addl="%events-send-1", hot=0, history="ShADd"]F938"ational Internet Measurement Infrastructure).^J</ul>^J^J<h2>^J<a href="./collaborators.html">^JCollaborators</a>^J</h2>^J^J<!--^J&nbsp; &nbsp;<b>Multicast and Multimedia</b>^J<ul>^J<LI><A href="/malloc/">MALLOC</a>^J(Multicast Address Allocation).^J<LI><a href="http://www.cs.columbia.edu/~hgs/sip/">SIP</a>^J(Session Initiation Protocol).^J<li> <a href="yoid"> Yoid</a> (host-based content distribution). ^J</ul>^J-->^J^J</td>^J^J</tr>^J</table>^J</DIV>^J^J<hr>^J<h2>Information for <a href="./abouticir.html">visitors</a> and <a href="/sysdocs/">local users</a>.</h2>^J<hr>^JLast modified: June 2004. <a href="./COPYRIGHTS">Copyright notice</a>.^J<a href="http://web.archive.org/web/*/http://www.aciri.org/">^JOlder versions</a> of this web page, in its ACIRI incarnation..^J<BR>^JFor more information about this server, mail <I>www@aciri.org</I>.  ^J<BR>^JTo report <a href="scanning.html">unusual activity</a> by any of our hosts, mail <I>abuse@aciri.org</I>.^J</BODY>^J")
-Event [xxxxxxxxxx.xxxxxx] http_header([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=0, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.183290958404541, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShAD"]T"ACCEPT""*/*")
-Event [xxxxxxxxxx.xxxxxx] http_header([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=0, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.183290958404541, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShAD"]T"CONNECTION""Keep-Alive")
-Event [xxxxxxxxxx.xxxxxx] http_header([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=0, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.183290958404541, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShAD"]T"HOST""www.icir.org")
-Event [xxxxxxxxxx.xxxxxx] http_header([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=0, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.183290958404541, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShAD"]T"USER-AGENT""Wget/1.10")
-Event [xxxxxxxxxx.xxxxxx] http_header([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=1448, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.367331027984619, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShADd"]F"ACCEPT-RANGES""bytes")
-Event [xxxxxxxxxx.xxxxxx] http_header([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=1448, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.367331027984619, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShADd"]F"CONNECTION""Keep-Alive")
-Event [xxxxxxxxxx.xxxxxx] http_header([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=1448, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.367331027984619, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShADd"]F"CONTENT-LENGTH""9130")
-Event [xxxxxxxxxx.xxxxxx] http_header([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=1448, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.367331027984619, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShADd"]F"CONTENT-TYPE""text/html")
-Event [xxxxxxxxxx.xxxxxx] http_header([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=1448, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.367331027984619, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShADd"]F"DATE""Fri, 07 Oct 2005 23:23:55 GMT")
-Event [xxxxxxxxxx.xxxxxx] http_header([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=1448, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.367331027984619, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShADd"]F"ETAG"""2c96c-23aa-4346a0e5"")
-Event [xxxxxxxxxx.xxxxxx] http_header([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=1448, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.367331027984619, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShADd"]F"KEEP-ALIVE""timeout=15, max=100")
-Event [xxxxxxxxxx.xxxxxx] http_header([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=1448, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.367331027984619, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShADd"]F"LAST-MODIFIED""Fri, 07 Oct 2005 16:23:01 GMT")
-Event [xxxxxxxxxx.xxxxxx] http_header([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=1448, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.367331027984619, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShADd"]F"SERVER""Apache/1.3.33 (Unix)")
-Event [xxxxxxxxxx.xxxxxx] http_message_done([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=0, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.183290958404541, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShAD"]T[start=xxxxxxxxxx.xxxxxx, interrupted=F, finish_msg="message ends normally", body_length=0, content_gap_length=0, header_length=86])
-Event [xxxxxxxxxx.xxxxxx] http_message_done([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=9417, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.73563814163208, service={}, addl="%events-send-1 %events-rcv-1", hot=0, history="ShADd"]F[start=xxxxxxxxxx.xxxxxx, interrupted=F, finish_msg="message ends normally", body_length=9130, content_gap_length=0, header_length=265])
-Event [xxxxxxxxxx.xxxxxx] http_reply([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=1448, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.367331027984619, service={}, addl="%events-send-1", hot=0, history="ShADd"]"1.1"200"OK")
-Event [xxxxxxxxxx.xxxxxx] http_request([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=0, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.183290958404541, service={}, addl="", hot=0, history="ShAD"]"GET""/""/""1.0")
-Event [xxxxxxxxxx.xxxxxx] net_done(xxxxxxxxxx.xxxxxx)
-Event [xxxxxxxxxx.xxxxxx] new_connection([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=0, state=0], resp=[size=0, state=0], start_time=xxxxxxxxxx.xxxxxx, duration=0.0, service={}, addl="", hot=0, history=""])
-Event [xxxxxxxxxx.xxxxxx] new_connection([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=0, state=1], resp=[size=0, state=0], start_time=xxxxxxxxxx.xxxxxx, duration=0.0, service={}, addl="cc=1", hot=0, history=""])
-Event [xxxxxxxxxx.xxxxxx] protocol_confirmation([id=[orig_h=141.42.64.125, orig_p=56730/tcp, resp_h=125.190.109.199, resp_p=80/tcp], orig=[size=98, state=4], resp=[size=0, state=4], start_time=xxxxxxxxxx.xxxxxx, duration=0.183290958404541, service={}, addl="", hot=0, history="ShAD"]165)
diff --git a/testing/istate/base/events-rcv/conn.log b/testing/istate/base/events-rcv/conn.log
deleted file mode 100644
index b38c0a2e70..0000000000
--- a/testing/istate/base/events-rcv/conn.log
+++ /dev/null
@@ -1,2 +0,0 @@
-xxxxxxxxxx.xxxxxx 0.182433 141.42.64.125 125.190.109.199 other 56729 12345 tcp ? ? REJ X
-xxxxxxxxxx.xxxxxx 1.733303 141.42.64.125 125.190.109.199 http 56730 80 tcp 98 9417 SF X %events-send-1
diff --git a/testing/istate/base/events-rcv/http.log b/testing/istate/base/events-rcv/http.log
deleted file mode 100644
index db049772d8..0000000000
--- a/testing/istate/base/events-rcv/http.log
+++ /dev/null
@@ -1,18 +0,0 @@
-xxxxxxxxxx.xxxxxx %events-rcv-1 start 141.42.64.125:56730 > 125.190.109.199:80
-xxxxxxxxxx.xxxxxx %events-rcv-1 > USER-AGENT: Wget/1.10
-xxxxxxxxxx.xxxxxx %events-rcv-1 > ACCEPT: */*
-xxxxxxxxxx.xxxxxx %events-rcv-1 > HOST: www.icir.org
-xxxxxxxxxx.xxxxxx %events-rcv-1 > CONNECTION: Keep-Alive
-xxxxxxxxxx.xxxxxx %events-rcv-1 < DATE: Fri, 07 Oct 2005 23:23:55 GMT
-xxxxxxxxxx.xxxxxx %events-rcv-1 < SERVER: Apache/1.3.33 (Unix)
-xxxxxxxxxx.xxxxxx %events-rcv-1 < LAST-MODIFIED: Fri, 07 Oct 2005 16:23:01 GMT
-xxxxxxxxxx.xxxxxx %events-rcv-1 < ETAG: "2c96c-23aa-4346a0e5"
-xxxxxxxxxx.xxxxxx %events-rcv-1 < ACCEPT-RANGES: bytes
-xxxxxxxxxx.xxxxxx %events-rcv-1 < CONTENT-LENGTH: 9130
-xxxxxxxxxx.xxxxxx %events-rcv-1 < KEEP-ALIVE: timeout=15, max=100
-xxxxxxxxxx.xxxxxx %events-rcv-1 < CONNECTION: Keep-Alive
-xxxxxxxxxx.xxxxxx %events-rcv-1 < CONTENT-TYPE: text/html
-xxxxxxxxxx.xxxxxx %events-rcv-1 <= 4096 bytes: "<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML ..."
-xxxxxxxxxx.xxxxxx %events-rcv-1 <= 4096 bytes: "gn=top>^J^J<h2>^JPublications^J</h2>^J<ul>^J<l..."
-xxxxxxxxxx.xxxxxx %events-rcv-1 <= 938 bytes: "ational Internet Measurement Infrastruct..."
-xxxxxxxxxx.xxxxxx %events-rcv-1 GET / (200 "OK" [9130] www.icir.org)
diff --git a/testing/istate/base/events-rcv/stderr.log b/testing/istate/base/events-rcv/stderr.log
deleted file mode 100644
index bb611b7eb0..0000000000
--- a/testing/istate/base/events-rcv/stderr.log
+++ /dev/null
@@ -1,3 +0,0 @@
-xxxxxxxxxx.xxxxxx processing suspended
-xxxxxxxxxx.xxxxxx processing continued
-xxxxxxxxxx.xxxxxx received termination signal
diff --git a/testing/istate/base/events-rcv/stdout.log b/testing/istate/base/events-rcv/stdout.log
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/testing/istate/base/events-send/conn.log b/testing/istate/base/events-send/conn.log
deleted file mode 100644
index 3ac12d6d4b..0000000000
--- a/testing/istate/base/events-send/conn.log
+++ /dev/null
@@ -1,3 +0,0 @@
-xxxxxxxxxx.xxxxxx 0.182433 141.42.64.125 125.190.109.199 other 56729 12345 tcp ? ? REJ X
-xxxxxxxxxx.xxxxxx 1.733303 141.42.64.125 125.190.109.199 http 56730 80 tcp 98 9417 SF X %events-send-1
-xxxxxxxxxx.xxxxxx ? 141.42.64.125 125.190.109.199 http 56730 80 tcp ? ? OTH X
diff --git a/testing/istate/base/events-send/http.log b/testing/istate/base/events-send/http.log
deleted file mode 100644
index 2ffab6810e..0000000000
--- a/testing/istate/base/events-send/http.log
+++ /dev/null
@@ -1,18 +0,0 @@
-xxxxxxxxxx.xxxxxx %events-send-1 start 141.42.64.125:56730 > 125.190.109.199:80
-xxxxxxxxxx.xxxxxx %events-send-1 > USER-AGENT: Wget/1.10
-xxxxxxxxxx.xxxxxx %events-send-1 > ACCEPT: */*
-xxxxxxxxxx.xxxxxx %events-send-1 > HOST: www.icir.org
-xxxxxxxxxx.xxxxxx %events-send-1 > CONNECTION: Keep-Alive
-xxxxxxxxxx.xxxxxx %events-send-1 < DATE: Fri, 07 Oct 2005 23:23:55 GMT
-xxxxxxxxxx.xxxxxx %events-send-1 < SERVER: Apache/1.3.33 (Unix)
-xxxxxxxxxx.xxxxxx %events-send-1 < LAST-MODIFIED: Fri, 07 Oct 2005 16:23:01 GMT
-xxxxxxxxxx.xxxxxx %events-send-1 < ETAG: "2c96c-23aa-4346a0e5"
-xxxxxxxxxx.xxxxxx %events-send-1 < ACCEPT-RANGES: bytes
-xxxxxxxxxx.xxxxxx %events-send-1 < CONTENT-LENGTH: 9130
-xxxxxxxxxx.xxxxxx %events-send-1 < KEEP-ALIVE: timeout=15, max=100
-xxxxxxxxxx.xxxxxx %events-send-1 < CONNECTION: Keep-Alive
-xxxxxxxxxx.xxxxxx %events-send-1 < CONTENT-TYPE: text/html
-xxxxxxxxxx.xxxxxx %events-send-1 <= 4096 bytes: "<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML ..."
-xxxxxxxxxx.xxxxxx %events-send-1 <= 4096 bytes: "gn=top>^J^J<h2>^JPublications^J</h2>^J<ul>^J<l..."
-xxxxxxxxxx.xxxxxx %events-send-1 <= 938 bytes: "ational Internet Measurement Infrastruct..."
-xxxxxxxxxx.xxxxxx %events-send-1 GET / (200 "OK" [9130] www.icir.org)
diff --git a/testing/istate/base/events-send/stderr.log b/testing/istate/base/events-send/stderr.log
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/testing/istate/base/events-send/stdout.log b/testing/istate/base/events-send/stdout.log
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/testing/istate/base/persistence-read/stderr.log b/testing/istate/base/persistence-read/stderr.log
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/testing/istate/base/persistence-read/stdout.log b/testing/istate/base/persistence-read/stdout.log
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/testing/istate/base/persistence-read/vars.log b/testing/istate/base/persistence-read/vars.log
deleted file mode 100644
index 129c730768..0000000000
--- a/testing/istate/base/persistence-read/vars.log
+++ /dev/null
@@ -1,33 +0,0 @@
-42
--42
-Hallihallo
-1.2.3.4
-1.2.0.0/16
-3.14
-131.159
-42.0 secs
-{
-[1] = qwerty,
-[2] = uiop
-}
-file "test" of string
-/^?(12345)$?/
-{
-3,
-5,
-4,
-1,
-2
-}
-{
-[2, DEF] = 102,
-[1, ABC] = 101,
-[3, GHI] = 103
-}
-{
-[12345] = /^?(12345)$?/,
-[12346] = /^?(12345)$?/
-}
-42/udp
-[1, 2, 3]
-[a=yuyuyu, b=[a=rec1, b=100, c=1.24], c=[a=rec2, b=200, c=2.24], d=7.77]
diff --git a/testing/istate/base/persistence-write/stderr.log b/testing/istate/base/persistence-write/stderr.log
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/testing/istate/base/persistence-write/stdout.log b/testing/istate/base/persistence-write/stdout.log
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/testing/istate/base/persistence-write/vars.log b/testing/istate/base/persistence-write/vars.log
deleted file mode 100644
index 129c730768..0000000000
--- a/testing/istate/base/persistence-write/vars.log
+++ /dev/null
@@ -1,33 +0,0 @@
-42
--42
-Hallihallo
-1.2.3.4
-1.2.0.0/16
-3.14
-131.159
-42.0 secs
-{
-[1] = qwerty,
-[2] = uiop
-}
-file "test" of string
-/^?(12345)$?/
-{
-3,
-5,
-4,
-1,
-2
-}
-{
-[2, DEF] = 102,
-[1, ABC] = 101,
-[3, GHI] = 103
-}
-{
-[12345] = /^?(12345)$?/,
-[12346] = /^?(12345)$?/
-}
-42/udp
-[1, 2, 3]
-[a=yuyuyu, b=[a=rec1, b=100, c=1.24], c=[a=rec2, b=200, c=2.24], d=7.77]
diff --git a/testing/istate/base/sync-rcv/remote.log b/testing/istate/base/sync-rcv/remote.log
deleted file mode 100644
index 01c0aa34cc..0000000000
--- a/testing/istate/base/sync-rcv/remote.log
+++ /dev/null
@@ -1,21 +0,0 @@
-xxxxxxxxxx.xxxxxx [info]  [parent] raised pipe's socket buffer size from 126K to 1024K
-xxxxxxxxxx.xxxxxx [info]  [parent] communication started, parent 
-xxxxxxxxxx.xxxxxx [info]  [parent] [#1/127.0.0.1:47757] added peer
-xxxxxxxxxx.xxxxxx [info]  [child]  [#1/127.0.0.1:47757] connected
-xxxxxxxxxx.xxxxxx [info]  [parent] [#1/127.0.0.1:47757] peer connected
-xxxxxxxxxx.xxxxxx [info]  [parent] [#1/127.0.0.1:47757] phase: version
-xxxxxxxxxx.xxxxxx [info]  [script] [#1/127.0.0.1:47757] connection established
-xxxxxxxxxx.xxxxxx [info]  [script] [#1/127.0.0.1:47757] requesting events matching /^?(.*)$?/
-xxxxxxxxxx.xxxxxx [info]  [script] [#1/127.0.0.1:47757] accepting state
-xxxxxxxxxx.xxxxxx [info]  [script] [#1/127.0.0.1:47757] requesting synchronized state
-xxxxxxxxxx.xxxxxx [info]  [parent] [#1/127.0.0.1:47757] phase: handshake
-xxxxxxxxxx.xxxxxx [info]  [parent] [#1/127.0.0.1:47757] peer_description is not set
-xxxxxxxxxx.xxxxxx [info]  [parent] [#1/127.0.0.1:47757] peer supports keep-in-cache; using that
-xxxxxxxxxx.xxxxxx [info]  [parent] [#1/127.0.0.1:47757] phase: sync (sender)
-xxxxxxxxxx.xxxxxx [info]  [parent] [#1/127.0.0.1:47757] starting to send full state
-xxxxxxxxxx.xxxxxx [info]  [parent] [#1/127.0.0.1:47757] done sending full state
-xxxxxxxxxx.xxxxxx [info]  [parent] [#1/127.0.0.1:47757] phase: running
-xxxxxxxxxx.xxxxxx [info]  [script] [#1/127.0.0.1:47757] connection closed
-xxxxxxxxxx.xxxxxx [info]  [parent] [#1/127.0.0.1:47757] peer disconnected
-xxxxxxxxxx.xxxxxx [info]  [child]  [#1/127.0.0.1:47757] connection closed
-xxxxxxxxxx.xxxxxx [info]  [parent] [#1/127.0.0.1:47757] closing connection
diff --git a/testing/istate/base/sync-rcv/stderr.log b/testing/istate/base/sync-rcv/stderr.log
deleted file mode 100644
index 788f8009fe..0000000000
--- a/testing/istate/base/sync-rcv/stderr.log
+++ /dev/null
@@ -1 +0,0 @@
-xxxxxxxxxx.xxxxxx received termination signal
diff --git a/testing/istate/base/sync-rcv/stdout.log b/testing/istate/base/sync-rcv/stdout.log
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/testing/istate/base/sync-rcv/vars.log b/testing/istate/base/sync-rcv/vars.log
deleted file mode 100644
index a86d2a82da..0000000000
--- a/testing/istate/base/sync-rcv/vars.log
+++ /dev/null
@@ -1,34 +0,0 @@
-421
-1234567
-Jodel
-4.3.2.1
-4.0.0.0/8
-21.0
-192.150.186
-42.0 secs
-{
-[3] = asdfg1,
-[1] = asdfg2
-}
-file "test2" of string
-/^?(abbcdefgh)$?/
-{
-3,
-5,
-6,
-4,
-2
-}
-{
-[4, JKL] = 104,
-[2, DEF] = 103,
-[3, GHI] = 103
-}
-{
-[12345] = /^?(12345)$?/,
-[6767] = /^?(QWERTZ)$?/,
-[12346] = /^?(12345)$?/
-}
-6667/tcp
-[2, 20, 3, 4]
-[a=zxzxzx, b=[a=pop, b=43, c=9.999], c=[a=IOIOI, b=201, c=612.2], d=6.6666]
diff --git a/testing/istate/base/sync-send/stderr.log b/testing/istate/base/sync-send/stderr.log
deleted file mode 100644
index 4f2df4e549..0000000000
--- a/testing/istate/base/sync-send/stderr.log
+++ /dev/null
@@ -1,2 +0,0 @@
-xxxxxxxxxx.xxxxxx processing suspended
-xxxxxxxxxx.xxxxxx processing continued
diff --git a/testing/istate/base/sync-send/stdout.log b/testing/istate/base/sync-send/stdout.log
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/testing/istate/base/sync-send/vars.log b/testing/istate/base/sync-send/vars.log
deleted file mode 100644
index a86d2a82da..0000000000
--- a/testing/istate/base/sync-send/vars.log
+++ /dev/null
@@ -1,34 +0,0 @@
-421
-1234567
-Jodel
-4.3.2.1
-4.0.0.0/8
-21.0
-192.150.186
-42.0 secs
-{
-[3] = asdfg1,
-[1] = asdfg2
-}
-file "test2" of string
-/^?(abbcdefgh)$?/
-{
-3,
-5,
-6,
-4,
-2
-}
-{
-[4, JKL] = 104,
-[2, DEF] = 103,
-[3, GHI] = 103
-}
-{
-[12345] = /^?(12345)$?/,
-[6767] = /^?(QWERTZ)$?/,
-[12346] = /^?(12345)$?/
-}
-6667/tcp
-[2, 20, 3, 4]
-[a=zxzxzx, b=[a=pop, b=43, c=9.999], c=[a=IOIOI, b=201, c=612.2], d=6.6666]
diff --git a/testing/istate/istate.py b/testing/istate/istate.py
deleted file mode 100755
index 72b3eb4288..0000000000
--- a/testing/istate/istate.py
+++ /dev/null
@@ -1,174 +0,0 @@
-#! /usr/bin/env python
-#
-# Tests persistence.
-#
-# $Id: istate.py,v 1.1.2.4 2005/10/11 22:31:42 sommer Exp $
-
-import time
-import os
-import os.path
-import optparse
-import sys
-import subprocess
-
-import tests
-
-optparser = optparse.OptionParser( usage = "%prog [options]", version = "0.1" )
-optparser.add_option( "-s", "--show-diff", action = "store_true", dest = "showdiff",
-                    default = False, help = "show diffs of mismatches" )
-optparser.add_option( "-b", "--new-base", action = "store_true", dest = "newbase",
-                    default = False, help = "create new baseline" )
-optparser.add_option( "-d", "--debug", action = "store_true", dest = "debug",
-                    default = False, help = "enable debug output" )
-optparser.add_option( "-t", "--set", action = "store", type = "string", dest = "set",
-                    default = None, help = "only do given test set" )
-
-
-( tests.Options, args ) = optparser.parse_args()
-
-if len(args) != 0:
-    optparser.error( "Wrong number of arguments" )
-
-##########################################
-# Write persistent data and read it back.
-##########################################
-
-if tests.testSet("persistence"):
-
-    tests.spawnBro("persistence-write",
-               ["-r", os.path.join(tests.Traces, "empty.trace"),
-                os.path.join(tests.Scripts, "vars-init.bro"),
-                os.path.join(tests.Scripts, "vars-print.bro")])
-    tests.waitProc("persistence-write")
-    tests.finishTest("persistence-write", ["stdout.log", "stderr.log", "vars.log"])
-
-    tests.spawnBro("persistence-read",
-               [os.path.join(tests.Scripts, "vars-declare.bro"),
-                os.path.join(tests.Scripts, "vars-print.bro")],
-                copy=[os.path.join(tests.workDir("persistence-write"), ".state")])
-    tests.waitProc("persistence-read")
-    tests.finishTest("persistence-read", ["stdout.log", "stderr.log", "vars.log"])
-
-    tests.compareFiles("persistence-write", "persistence-read", ["vars.log"])
-
-##########################################
-# Exchange events (clear-text).
-#
-# The used trace contains two connections separated by a silence of a
-# couple of seconds. We start the processes so that the events for the
-# *second* one (which is a full HTTP connection) are exchanged.
-##########################################
-
-if tests.testSet("events"):
-
-    tests.spawnBro("events-send",
-               ["-r", os.path.join(tests.Scripts, os.path.join(tests.Traces, "web.trace")),
-                "--pseudo-realtime",
-                "-C",
-               os.path.join(tests.Scripts, "events-send.bro")])
-    time.sleep(2)
-    tests.spawnBro("events-rcv",
-               [os.path.join(tests.Scripts, "events-rcv.bro")])
-    tests.waitProc("events-send")
-    tests.killProc("events-rcv")
-    tests.finishTest("events-send", ["stdout.log", "stderr.log", "http.log", "conn.log"], ignoreTime=True)
-    tests.finishTest("events-rcv", ["stdout.log", "stderr.log", "http.log", "conn.log"], ignoreTime=True)
-
-    tests.spawnBro("events-display",
-               ["-x", os.path.join(tests.workDir("events-rcv"), "events.bst")])
-    tests.waitProc("events-display")
-    tests.finishTest("events-display", ["stdout.log"], ignoreTime=True, sort=True, delete=['127.0.0.1:[0-9]*',"Event.*remote_.*"])
-
-    tests.compareFiles("events-send", "events-rcv", ["http.log"], ignoreTime=True, ignoreSessionID=True)
-
-##########################################
-# Exchange synchronized state
-##########################################
-
-if tests.testSet("sync"):
-
-    tests.spawnBro("sync-send",
-               [os.path.join(tests.Scripts, "vars-sync-send.bro")])
-    tests.spawnBro("sync-rcv",
-               [os.path.join(tests.Scripts, "vars-sync-rcv.bro")])
-    tests.waitProc("sync-send")
-    time.sleep(1)
-    tests.killProc("sync-rcv")
-    tests.finishTest("sync-send", ["stdout.log", "stderr.log", "vars.log"], ignoreTime=True)
-    tests.finishTest("sync-rcv", ["stdout.log", "stderr.log", "vars.log", "remote.log"], ignoreTime=True, delete=["pid.*pid.*", "temporarily unavailable \\[..\\]"])
-
-    tests.compareFiles("sync-send", "sync-rcv", ["vars.log"], ignoreTime=True)
-
-# Old version
-#    tests.spawnBro("sync-send",
-#               ["-r", os.path.join(tests.Scripts, os.path.join(tests.Traces, "web.trace")),
-#       	        "--pseudo-realtime",
-#                "-C",
-#               os.path.join(tests.Scripts, "vars-sync-send.bro")])
-
-##########################################
-# Test Broccoli with bro-ping
-##########################################
-
-
-if tests.testSet("broccoli"):
-
-    broctest = os.path.join(tests.BroBase, "aux/broccoli/test")
-    broclib = os.path.join(tests.BroBase, "build/aux/broccoli/src/")
-    broping = os.path.join(tests.BroBase, "build/aux/broccoli/test/broping")
-
-    brocpy = os.path.join(tests.BroBase, "build/aux/broccoli/bindings/broccoli-python")
-
-    broccoli = True
-
-    # Test if Broccoli was compiled.
-    if not os.path.exists(broping):
-        print "    Broccoli was not compiled, skipping tests."
-        broccoli = False
-
-    # Test if this is a IPv6 Bro.
-    if broccoli:
-        v6 = subprocess.call(["grep", "-q", "#define BROv6", os.path.join(tests.BroBase, "build/config.h")])
-        if v6 == 0:
-            print "    Bro built with IPv6 support not compatible with Broccoli, skipping tests."
-            broccoli = False
-
-    if broccoli:
-        tests.spawnBro("bro-ping", [os.path.join(broctest, "broping-record.bro")])
-        time.sleep(1)
-        tests.spawnProc("broccoli-ping",
-                        [broping,
-                        "-r",
-                        "-c", "5",
-                        "127.0.0.1"])
-        tests.waitProc("broccoli-ping")
-        tests.killProc("bro-ping")
-
-        tests.finishTest("bro-ping", ["stdout.log", "stderr.log", "remote.log"],
-                         ignoreTime=True, delete=["127.0.0.1:[0-9]*", "pid.*pid.*",
-                         ".*Resource temporarily unavailable.*", ".*connection closed.*",
-                         ".*peer disconnected.*"])
-        tests.finishTest("broccoli-ping", ["stdout.log", "stderr.log"],
-                         delete=["time=.* s$"])
-
-        # Test if Python binding are installed.
-        sopath = subprocess.Popen(["find", brocpy, "-name", "_broccoli_intern.so"], stdout=subprocess.PIPE).communicate()[0]
-        if sopath != "":
-
-            os.environ["LD_LIBRARY_PATH"] = broclib
-            os.environ["DYLD_LIBRARY_PATH"] = broclib
-            os.environ["PYTHONPATH"] = os.path.dirname(sopath)
-
-            tests.spawnBro("python-bro", [os.path.join(brocpy, "tests/test.bro")])
-            time.sleep(1)
-            tests.spawnProc("python-script", [os.path.join(brocpy, "tests/test.py")])
-            tests.waitProc("python-script")
-            tests.killProc("python-bro")
-            tests.finishTest("python-bro", ["stdout.log"], ignoreTime=True)
-            tests.finishTest("python-script", ["stdout.log"], ignoreTime=True, delete=["0x[^>]*", ".[0-9]{2}"])
-        else:
-            print "    Python bindings not built, skipping test."
-            print "       (To build: cd %s && python setup.py build)" % brocpy
-
-
-
diff --git a/testing/istate/rndseed.dat b/testing/istate/rndseed.dat
deleted file mode 100644
index 3bc70c899b..0000000000
--- a/testing/istate/rndseed.dat
+++ /dev/null
@@ -1,17 +0,0 @@
-1971283154
-1128552575
-26676
-875311974
-790730425
-1553617948
-3593004090
-2070230499
-1420669195
-754343139
-2906181924
-542878596
-2459738795
-924396623
-743111462
-3363354015
-198575356
diff --git a/testing/istate/scripts/events-rcv.bro b/testing/istate/scripts/events-rcv.bro
deleted file mode 100644
index a345e3fa49..0000000000
--- a/testing/istate/scripts/events-rcv.bro
+++ /dev/null
@@ -1,18 +0,0 @@
-# $Id: events-rcv.bro,v 1.1.2.1 2005/10/07 01:59:12 sommer Exp $
-
-@load tcp
-@load http-request
-@load http-reply
-@load http-header
-@load http-body
-@load http-abstract
-	
-@load capture-events	
-@load remote
-	
-redef peer_description = "events-rcv";
-	
-redef Remote::destinations += {
-    ["foo"] = [$host = 127.0.0.1, $events = /.*/, $connect=T]
-};
-
diff --git a/testing/istate/scripts/events-send.bro b/testing/istate/scripts/events-send.bro
deleted file mode 100644
index 00975fd723..0000000000
--- a/testing/istate/scripts/events-send.bro
+++ /dev/null
@@ -1,21 +0,0 @@
-# $Id: events-send.bro,v 1.1.2.1 2005/10/07 01:59:12 sommer Exp $
-
-@load tcp
-@load http-request
-@load http-reply
-@load http-header
-@load http-body
-@load http-abstract
-@load listen-clear
-	
-@load capture-events	
-	
-redef peer_description = "events-send";
-
-# Make sure the HTTP connection really gets out.
-# (We still miss one final connection event because we shutdown before
-# it gets propagated but that's ok.)
-redef tcp_close_delay = 0secs;
-
-	
-	
diff --git a/testing/istate/scripts/vars-declare.bro b/testing/istate/scripts/vars-declare.bro
deleted file mode 100644
index 871e518109..0000000000
--- a/testing/istate/scripts/vars-declare.bro
+++ /dev/null
@@ -1,36 +0,0 @@
-# $Id: vars-declare.bro,v 1.1.2.2 2005/10/11 21:15:05 sommer Exp $
-#
-# Declares variables.
-
-global foo1: count &persistent &synchronized;
-global foo2: int &persistent &synchronized;
-global foo3: string &persistent &synchronized; 
-global foo4: addr &persistent &synchronized; 
-global foo5: subnet &persistent &synchronized; 
-global foo6: double &persistent &synchronized; 
-global foo7: net &persistent &synchronized; 
-global foo8: interval &persistent &synchronized; 
-global foo9: table[count] of string &persistent &synchronized;
-global foo10: file &persistent &synchronized; 
-global foo11: pattern &persistent &synchronized; 
-global foo12: set[count] &persistent &synchronized; 
-global foo13: table[count, string] of count &persistent &synchronized;
-global foo14: table[count] of pattern &persistent &synchronized;
-global foo15: port &persistent &synchronized;
-global foo16: vector of count &persistent &synchronized;
-
-type type1: record {
-    a: string;
-    b: count &default=42;
-    c: double &optional;
-    };
-
-type type2: record {
-    a: string;
-    b: type1;
-    c: type1;
-    d: double;
-    };
-
-global foo17: type2  &persistent &synchronized;
-
diff --git a/testing/istate/scripts/vars-init.bro b/testing/istate/scripts/vars-init.bro
deleted file mode 100644
index 79b1345f31..0000000000
--- a/testing/istate/scripts/vars-init.bro
+++ /dev/null
@@ -1,42 +0,0 @@
-# $Id: vars-init.bro,v 1.1.2.2 2005/10/11 21:15:05 sommer Exp $
-# 
-# Instantiates variables.
-
-global foo1 = 42 &persistent &synchronized;
-global foo2 = -42 &persistent &synchronized;
-global foo3 = "Hallihallo" &persistent &synchronized; 
-global foo4 = 1.2.3.4 &persistent &synchronized; 
-global foo5 = 1.2.0.0/16 &persistent &synchronized; 
-global foo6 = 3.14 &persistent &synchronized; 
-global foo7 = 131.159. &persistent &synchronized; 
-global foo8 = 42 secs &persistent &synchronized; 
-global foo9 = { [1] = "qwerty", [2] = "uiop" } &persistent &synchronized;
-global foo10 = open("test") &persistent &synchronized; 
-global foo11 = /12345/ &persistent &synchronized; 
-global foo12 = { 1,2,3,4,5 } &persistent &synchronized; 
-global foo13  =  { [1,"ABC"] = 101, [2,"DEF"] = 102, [3,"GHI"] = 103 } &persistent &synchronized;
-global foo14  =  { [12345] = foo11, [12346] = foo11 } &persistent &synchronized;
-global foo15 = 42/udp &persistent &synchronized;
-global foo16: vector of count = [1,2,3] &persistent &synchronized;
- 
-type type1: record {
-    a: string;
-    b: count &default=42;
-    c: double &optional;
-    };
-
-type type2: record {
-    a: string;
-    b: type1;
-    c: type1;
-    d: double;
-    };
-
-global foo17: type2 = [
-	$a = "yuyuyu",
-    $b = [$a="rec1", $b=100, $c=1.24],
-    $c = [$a="rec2", $b=200, $c=2.24],
-   	$d = 7.77				   
-	] &persistent &synchronized;
-
-
diff --git a/testing/istate/scripts/vars-modify.bro b/testing/istate/scripts/vars-modify.bro
deleted file mode 100644
index 51f723f90d..0000000000
--- a/testing/istate/scripts/vars-modify.bro
+++ /dev/null
@@ -1,61 +0,0 @@
-# $Id: vars-modify.bro,v 1.1.2.2 2005/10/11 21:15:05 sommer Exp $
-#
-# Performs modifications on variables.
-
-function modify()
-	{
-	foo1 = 420;
-	++foo1;
-	
-	--foo2;
-	
-	foo3 = "Jodel";
-	
-	foo4 = 4.3.2.1; 
-	
-	foo5 = 4.0.0.0/8; 
-	
-	foo6 = 21;
-	
-	foo7 = 192.150.186; 
-	
-	foo9[3] = "asdfg1";
-	foo9[1] = "asdfg2";
-	delete foo9[2];
-	
-	foo10 = open("test2");
-	
-	foo11 = /abbcdefgh/;
-	
-	add foo12[6];
-	delete foo12[1];
-	
-	foo13[4,"JKL"] = 104;
-	delete foo13[1,"ABC"];
-	++foo13[2,"DEF"];
-	
-	foo14[6767] = /QWERTZ/;
-	
-	foo15 = 6667/tcp;
-	
-	foo16[4] = 4;
-	foo16[2] = 20;
-	++foo16[1];
-	
-	local x: type1;
-	x$a = "pop";
-	++x$b;
-	x$c = 9.999;
-	foo17$a = "zxzxzx";
-	foo17$b = x;
-	foo17$c$a = "IOIOI";
-	++foo17$c$b;
-	foo17$c$c = 612.2;
-	foo17$d = 6.6666;
-	
-	foo2 = 1234567;
-	}
-
-
-
-
diff --git a/testing/istate/scripts/vars-print.bro b/testing/istate/scripts/vars-print.bro
deleted file mode 100644
index 26d846c9cc..0000000000
--- a/testing/istate/scripts/vars-print.bro
+++ /dev/null
@@ -1,29 +0,0 @@
-# $Id: vars-print.bro,v 1.1.2.2 2005/10/11 21:15:05 sommer Exp $
-#
-# Print variables.
-
-event bro_done()
-	{
-	local out = open("vars.log");
-	print out, foo1;
-	print out, foo2;
-	print out, foo3;
-	print out, foo4;
-	print out, foo5;
-	print out, foo6;
-	print out, foo7;
-	print out, foo8;
-	print out, foo9;
-	print out, foo10;
-	print out, foo11;
-	print out, foo12;
-	print out, foo13;
-	print out, foo14;
-	print out, foo15;
-	print out, foo16;
-	print out, foo17;
-	}
-
-	
-	
-	
diff --git a/testing/istate/scripts/vars-sync-rcv.bro b/testing/istate/scripts/vars-sync-rcv.bro
deleted file mode 100644
index 145afd6ff6..0000000000
--- a/testing/istate/scripts/vars-sync-rcv.bro
+++ /dev/null
@@ -1,13 +0,0 @@
-# $Id: vars-sync-rcv.bro,v 1.1.2.1 2005/10/11 21:15:05 sommer Exp $
-
-@load vars-init
-@load vars-print
-
-@load capture-events	
-@load remote
-
-	
-redef Remote::destinations += {
-    ["foo"] = [$host = 127.0.0.1, $events = /.*/, $connect=T, $sync=T]
-};
-
diff --git a/testing/istate/scripts/vars-sync-send.bro b/testing/istate/scripts/vars-sync-send.bro
deleted file mode 100644
index 655c8a36ea..0000000000
--- a/testing/istate/scripts/vars-sync-send.bro
+++ /dev/null
@@ -1,20 +0,0 @@
-# $Id: vars-sync-send.bro,v 1.1.2.1 2005/10/11 21:15:05 sommer Exp $
-#
-
-@load vars-init
-@load vars-print
-@load vars-modify
-
-@load listen-clear
-
-event remote_connection_handshake_done(p: event_peer)
-	{
-	modify();
-	terminate_communication();
-	}
-			 
-redef Remote::destinations += {
-    ["foo"] = [$host = 127.0.0.1, $sync=T]
-};
-
-	
diff --git a/testing/istate/tests.py b/testing/istate/tests.py
deleted file mode 100644
index 0673108563..0000000000
--- a/testing/istate/tests.py
+++ /dev/null
@@ -1,300 +0,0 @@
-# $Id: tests.py,v 1.1.2.5 2005/10/11 22:31:42 sommer Exp $
-#
-# Various helper functions.
-
-import sys
-import os
-import copy
-import errno
-import signal
-import subprocess
-
-# Path to our files.
-Testing = os.path.abspath(".")
-
-# Path to top-level Bro directory.
-if os.path.exists("../../build/src/bro"):
-    BroBase = os.path.abspath("../..")
-else:
-    error("cannot find build directory")
-
-# Path where tmp files are created.
-Tmp = os.path.join(Testing, "tmp")
-
-# Path to seed file.
-BroSeed = os.path.join(Testing, "rndseed.dat")
-
-# Path to our test scripts.
-Scripts = os.path.join(Testing, "scripts")
-
-# Path to our test traces.
-Traces = os.path.join(Testing, "traces")
-
-# Where the base files to compare against are stored.
-Base = os.path.join(os.getcwd(), "./base")
-
-# Process ID of all processes we've spawned, indexed by textual tag *and* pid.
-Running = {}
-
-# Set to true when at least one check failed.
-Failed = False
-
-# getopt options
-Options = None
-
-def error(str):
-    print >>sys.stderr, "Error:", str
-    sys.exit(1)
-
-def debug(str):
-    if Options.debug:
-        print >>sys.stderr, "Debug:", str
-
-def log(str):
-    print >>sys.stderr, str
-
-# Returns full path of given process' working directory.
-def workDir(tag):
-    return os.path.join(Tmp, tag)
-
-# Intializes work dir for given process.
-def initWorkDir(tag):
-
-    try:
-        os.mkdir(Tmp)
-    except OSError, e:
-        if e.errno != errno.EEXIST:
-            raise
-
-    os.system("rm -rf " + workDir(tag))
-    os.mkdir(workDir(tag))
-
-# Spawns process identified by the given tag. Enters process into RunningBro.
-def spawnProc(tag, cmdline, copy=[]):
-    initWorkDir(tag)
-    os.chdir(workDir(tag))
-
-    for i in copy:
-        debug("Copying %s into workdir of %s" % (i, tag))
-        os.system("cp -r %s %s" % (i, workDir(tag)))
-
-    debug("Spawning '%s' as %s" % (" ".join(cmdline), tag))
-
-    saved_stdin = os.dup(0)
-    saved_stdout = os.dup(1)
-    saved_stderr = os.dup(2)
-    child_stdin = open("/dev/null", "r")
-    child_stdout = open("stdout.log", "w")
-    child_stderr = open("stderr.log", "w")
-    os.dup2(child_stdin.fileno(), 0)
-    os.dup2(child_stdout.fileno(), 1)
-    os.dup2(child_stderr.fileno(), 2)
-    pid = os.spawnvp(os.P_NOWAIT, cmdline[0], cmdline)
-    os.dup2(saved_stdin, 0)
-    os.dup2(saved_stdout, 1)
-    os.dup2(saved_stderr, 2)
-
-    Running[tag] = pid
-    Running[pid] = tag
-
-# Spaws a Bro process.
-def spawnBro(tag, args, copy=[]):
-    bropath =  os.path.join(BroBase, "policy")
-    bropath += ":" + os.path.join(BroBase, "build/src")
-
-    os.putenv("BROPATH", bropath + ":" + Scripts)
-    os.unsetenv("BRO_LOG_SUFFIX")
-    args += ["--load-seeds", BroSeed, "-B", "state,comm"]
-    spawnProc(tag, [os.path.join(BroBase, "build/src/bro")] + args, copy=copy)
-
-# Examines a process' exit code.
-def parseExitCode(tag, result):
-    if os.WCOREDUMP(result):
-        error("process %s core dumped." % tag)
-
-    if os.WIFSIGNALED(result):
-        error("process %s got signal %d." % (tag, os.WTERMSIG(result)))
-
-    if not os.WIFEXITED(result):
-        error("process %s exited abnormally (%d)." % (tag, result))
-
-    result = os.WEXITSTATUS(result)
-    debug("process %s exited with %d" % (tag, result))
-
-    return result
-
-# Waits for process to finish.
-def waitProc(tag):
-    (pid, result) = os.waitpid(Running[tag], 0)
-    result = parseExitCode(tag, result)
-    if result != 0:
-	error("Execution of %s failed." % tag)
-
-    del Running[pid]
-    del Running[tag]
-
-# Waits for all of our processes to terminte.
-def waitProcs():
-    while Running:
-        (pid, result) = os.waitpid(0, 0)
-        parseExitCode(Running[pid], result)
-        del Running[Running[pid]]
-        del Running[pid]
-
-# Kills the process and waits for its termination.
-def killProc(tag):
-    pid = Running[tag]
-    debug("Killing %s..." % tag)
-    os.kill(pid, signal.SIGTERM)
-    (pid, result) = os.waitpid(pid, 0)
-    parseExitCode(tag, result)
-    del Running[pid]
-    del Running[tag]
-
-# Cleans up temporary stuff
-def cleanup():
-    os.system("rm -rf " + Tmp)
-
-# Canonicalizes file content for diffing.
-def canonicalizeFile(file, ignoreTime, ignoreSessionID, sort, delete):
-
-    cmd = []
-
-    if delete:
-        for i in delete:
-            cmd += ["sed 's/%s//g' | grep -v '^$'" % i]
-
-    if ignoreTime:
-        cmd += ["sed 's/[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]\.[0-9][0-9]\{0,6\}/xxxxxxxxxx.xxxxxx/g'"]
-
-    if ignoreSessionID:
-        # A session is either "%1" or "%my-peer-description-1"
-        cmd += ["sed 's/%\([^ ]*-\)\{0,1\}[0-9][0-9]*/%XXX/g'"]
-
-    if sort:
-        cmd += ["LC_ALL=c sort"]
-
-    if not cmd:
-        return
-
-    tmp = file + ".tmp"
-    cmd = "cat %s | %s >%s" % (file, " | ".join(cmd), tmp)
-
-    debug("Canonicalizing '%s'" % cmd)
-    os.system(cmd)
-    os.system("mv %s %s" % (tmp, file))
-
-# Diffs the two files, If mismatch, prints "FAILED" and returns true.
-def diff(file1, file2):
-
-    quiet = ">/dev/null"
-    if Options.showdiff:
-        quiet = ""
-
-    for f in (file1, file2):
-        if not os.path.exists(f):
-            print "FAILED (%s does not exist)" % f
-            return False
-
-    diff = "diff -u %s %s %s" % (file1, file2, quiet)
-
-    debug("Executing '%s'" % diff)
-    result = os.system(diff)
-
-    if os.WEXITSTATUS(result) != 0:
-        print "FAILED"
-        return False
-
-    return True
-
-# Compares files of process against base version. Returns false if mismatch found.
-def checkFiles(tag, files, ignoreTime, sort, delete):
-    base = os.path.join(Base, tag)
-    work = workDir(tag)
-
-    print "    Checking %s..." % tag,
-
-    failed = False
-
-    for file in files:
-        oldfile = os.path.join(base, file)
-        newfile = os.path.join(work, file)
-
-        canonicalizeFile(newfile, ignoreTime, False, sort, delete)
-
-        if not diff(oldfile, newfile):
-            failed = True
-            break
-
-    if not failed:
-        print "ok"
-    else:
-        Failed = failed
-
-# Compares files of two processes. Return false if mismatch found.
-def compareFiles(tag1, tag2, files, ignoreTime=False, ignoreSessionID=False, sort=False, delete=None):
-    work1 = workDir(tag1)
-    work2 = workDir(tag2)
-
-    print "    Comparing %s with %s..." % (tag1, tag2),
-
-    failed = False
-
-    for file in files:
-        file1 = os.path.join(work1, file)
-        file2 = os.path.join(work2, file)
-
-        canonicalizeFile(file1, ignoreTime, ignoreSessionID, sort, delete)
-        canonicalizeFile(file2, ignoreTime, ignoreSessionID, sort, delete)
-
-        if not diff(file1, file2):
-            failed = True
-            break
-
-    if not failed:
-        print "ok"
-    else:
-        Failed = failed
-
-# Make the result of process new baseline.
-def makeNewBase(tag, files, ignoreTime, sort, delete):
-
-    try:
-        os.mkdir(Base)
-    except OSError, e:
-        if e.errno != errno.EEXIST:
-            raise
-
-    base = os.path.join(Base, tag)
-    work = workDir(tag)
-
-    print "    Copying files for %s..." % tag
-
-    try:
-        os.mkdir(base)
-    except OSError, e:
-        if e.errno != errno.EEXIST:
-            raise
-
-    # Delete all files but those belonging to CVS.
-    os.system("find %s -type f -not -path '*/CVS/*' -not -path '*/.svn/*' -exec rm '{}' ';'" % base)
-
-    for file in files:
-        oldfile = os.path.join(work, file)
-        newfile = os.path.join(base, file)
-	os.system("cp %s %s" % (oldfile, newfile))
-        canonicalizeFile(newfile, ignoreTime, False, sort, delete)
-
-def testSet(set):
-    if Options.set and set != Options.set:
-        return False
-
-    print "Running set '%s' ..." % set
-    return True
-
-# Either check given files or make it new baseline, depending on options.
-def finishTest(tag, files, ignoreTime=False, sort=False, delete=None):
-    if Options.newbase:
-	makeNewBase(tag, files, ignoreTime, sort, delete)
-    else:
-	checkFiles(tag, files, ignoreTime, sort, delete)
diff --git a/testing/istate/traces/empty.trace b/testing/istate/traces/empty.trace
deleted file mode 100644
index 3ee1117122..0000000000
Binary files a/testing/istate/traces/empty.trace and /dev/null differ