* use fr_tcpstate() with NAT code for increased NAT usage security or even
  fr_checkstate() - suspect this is not possible.

* see if the Solaris2 and dynamic plumb/unplumb problem is solvable
done ?

time permitting:

* load balancing across interfaces

* record buffering for TCP/UDP

* modular application proxying
on the way

* keep fragment information for state entries automatically.
done for NAT

* support traceroute through the firewall
  (i.e. fix up ICMP errors coming back for NAT)
done

* allow multiple ip addresses in a source route list for ipsend

* complete Linux port to implement all the IP Filter features
return-rst done, to/dup-to/fastroute remain - ip_forward() problems :-(

* add switches to ipmon for better selective control over which logs are
  read/not read
done

* add a flag to automate src spoofing

* ipfsync() should change IP#'s in current mappings as well as what's
  in rules.
 
* document bimap

* document NAT rule order processing

* document skip/preauth/auth
done

* add more docs

* add ICMP support to state checking code similar to that used for NAT so that
  the 'right' ICMP packets can get through.

