diff -rupN como-1.5//base/export.c como-1.5-new//base/export.c
--- como-1.5//base/export.c	2006-11-09 17:21:55.000000000 +0100
+++ como-1.5-new//base/export.c	2011-04-12 00:11:50.626449001 +0200
@@ -101,81 +101,6 @@ create_record(module_t * mdl, uint32_t h
 }
 
 
-/**
- * -- export_record
- *
- * Invoked by process_tables for each individual record that
- * is received by CAPTURE. It stores persistent state in the EXPORT
- * flow table. 
- *
- * Using the hash value in the flow_hdr, this block scans the hash
- * table to determine the bucket and store the info.
- * 
- */
-static int
-export_record(module_t * mdl, rec_t * rp)
-{
-    etable_t *et; 
-    rec_t *cand; 
-    uint32_t hash;
-    int isnew; 
-
-    start_tsctimer(map.stats->ex_export_timer); 
-
-    /* 
-     * get the right bucket in the hash table. we do not need to 
-     * compute a new hash but we use the same that was used in CAPTURE, 
-     * just a different number of bit, given the new size of the table.
-     */
-    et = mdl->ex_hashtable;
-    hash = rp->hash % et->size; 
-
-    /* 
-     * browse thru the elements in the bucket to 
-     * find the right one (with ematch())
-     */
-    for (cand = et->bucket[hash]; cand != NULL; cand = cand->next) {
-        int ret;
-
-        /* If there's no ematch() callback, any record matches */
-        if (mdl->callbacks.ematch == NULL)
-            break;
-        
-        ret = mdl->callbacks.ematch(mdl, cand, rp);
-        if (ret)
-            break;
-    }
-
-    isnew = 0; 
-    if (cand == NULL) {
-	cand = create_record(mdl, hash);
-	isnew = 1; 	/* new record */
-        cand->hash = rp->hash;
-    } 
-
-    /* 
-     * update the export record. 
-     */
-    mdl->callbacks.export(mdl, cand, rp, isnew);
-
-    /*
-     * move the record to the front of the bucket in the  
-     * hash table to speed up successive accesses
-     */
-    if (cand->prev) 
-	cand->prev->next = cand->next;
-    if (cand->next)
-	cand->next->prev = cand->prev;
-    if (cand != et->bucket[hash])
-        cand->next = et->bucket[hash];
-    if (cand->next)
-        cand->next->prev = cand;
-    cand->prev = NULL; 
-    et->bucket[hash] = cand;
-
-    end_tsctimer(map.stats->ex_export_timer); 
-    return 0;		// XXX just to have same prototype of call_store
-}
 
 
 /**
@@ -256,20 +181,98 @@ call_store(module_t * mdl, rec_t *rp)
 		/* print this record */
 		if (module_db_record_print(mdl, p, NULL, map.inline_fd) < 0)
 		    handle_print_fail(mdl);
-		
 		/* move to next */
 		p += sz;
 		left -= sz;
 	    }
 	}
     } while (done == 0);
-
     end_tsctimer(map.stats->ex_mapping_timer); 
+
     return ret;
 }
 
 
 /**
+ * -- export_record
+ *
+ * Invoked by process_tables for each individual record that
+ * is received by CAPTURE. It stores persistent state in the EXPORT
+ * flow table. 
+ *
+ * Using the hash value in the flow_hdr, this block scans the hash
+ * table to determine the bucket and store the info.
+ * 
+ */
+static int
+export_record(module_t * mdl, rec_t * rp)
+{
+    etable_t *et; 
+    rec_t *cand; 
+    uint32_t hash;
+    int isnew; 
+
+    start_tsctimer(map.stats->ex_export_timer); 
+
+    /* 
+     * get the right bucket in the hash table. we do not need to 
+     * compute a new hash but we use the same that was used in CAPTURE, 
+     * just a different number of bit, given the new size of the table.
+     */
+    et = mdl->ex_hashtable;
+    hash = rp->hash % et->size; 
+
+    /* 
+     * browse thru the elements in the bucket to 
+     * find the right one (with ematch())
+     */
+    for (cand = et->bucket[hash]; cand != NULL; cand = cand->next) {
+        int ret;
+
+        /* If there's no ematch() callback, any record matches */
+        if (mdl->callbacks.ematch == NULL)
+            break;
+        
+        ret = mdl->callbacks.ematch(mdl, cand, rp);
+        if (ret)
+            break;
+    }
+
+    isnew = 0; 
+    if (cand == NULL) {
+	cand = create_record(mdl, hash);
+	isnew = 1; 	/* new record */
+        cand->hash = rp->hash;
+    } 
+
+    /* 
+     * update the export record and check if is time to store
+     */   
+    if(mdl->callbacks.export(mdl, cand, rp, isnew)==1)
+         call_store(mdl, cand);
+
+    /*
+     * move the record to the front of the bucket in the  
+     * hash table to speed up successive accesses
+     */
+    if (cand->prev) 
+	cand->prev->next = cand->next;
+    if (cand->next)
+	cand->next->prev = cand->prev;
+    if (cand != et->bucket[hash])
+        cand->next = et->bucket[hash];
+    if (cand->next)
+        cand->next->prev = cand;
+    cand->prev = NULL; 
+    et->bucket[hash] = cand;
+
+    end_tsctimer(map.stats->ex_export_timer); 
+    return 0;		// XXX just to have same prototype of call_store
+}
+
+
+
+/**
  * -- process_table
  *
  * Process a table from the expired list (ct). It will go through the buckets
@@ -293,6 +296,7 @@ process_table(ctable_t * ct, module_t *
      * call export() if available, otherwise just store() and
      * bypass the rest of the export code (see above)
      */
+
     record_fn = mdl->callbacks.export? export_record : call_store;
 
     /*
@@ -624,6 +628,10 @@ ex_ipc_flush(procname_t sender, void *bu
 	if (mdl->status != MDL_ACTIVE)
 	    continue;
 
+        /*call one time the function action to perform operations on the entire table*/
+        if (mdl->callbacks.action != NULL)
+           mdl->callbacks.action(mdl, NULL, em->ct->ivl, em->ct->ts, 0);
+
 	if (em->ct->records) {
 	    /* process capture table and update export table */
 	    start_tsctimer(map.stats->ex_table_timer);
@@ -644,6 +652,7 @@ ex_ipc_flush(procname_t sender, void *bu
      * so it can merge and reuse the memory.
      */
     ipc_send(sender, IPC_FLUSH, buf, len);
+
 }
 
 
diff -rupN como-1.5//sniffers/sniffer-pcap.c como-1.5-new//sniffers/sniffer-pcap.c
--- como-1.5//sniffers/sniffer-pcap.c	2007-03-31 00:25:21.000000000 +0200
+++ como-1.5-new//sniffers/sniffer-pcap.c	2011-04-12 00:11:39.182449002 +0200
@@ -88,11 +88,20 @@ struct pcap_me {
 /* libpcap magic */
 #define PCAP_MAGIC 0xa1b2c3d4
 
+
+//timeval definition 64bit-compatible
+typedef struct _timeval
+{
+  uint32_t tv_sec;            /* Seconds.  */
+    uint32_t tv_usec;  /* Microseconds.  */
+}timeval_t;
+
+
 /* 
  * PCAP header. It precedes every packet in the file. 
  */
 typedef struct pcap_hdr {
-    struct timeval ts; 		/* time stamp */
+    struct _timeval ts; 		/* time stamp */
     int caplen;        		/* length of portion present */
     int len;			/* length this packet (on the wire) */
 } pcap_hdr_t;
