initial strawman document collecting application-specific data e.g. reconstruct full HTTP headers from packet level data flow aggregation parameters granularity timeout how much configurability queue lengths focus on IP level