Hi Philipp,

I know I've already mentioned some thoughts on this subject. I would be interested in your thoughts on the types of challenging questions such a hypothetical DSL might answer. I've already put some effort into this (forking metrics-lib), but I'm still new to working with tor network data. There's around a terabyte of it and I can't possibly imagine every interesting scenario at this point. Right now I'm trying to be as flexible (and general) as possible in the implementation. Besides what you've already mentioned, what other types of uses do you envision? I'm interested in being able to answer questions which can only be answered by looking at macroscopic details level over time. Things like how to draw interesting facts from performance data, and how to improve collection (signalling, messaging, new metrics, etc) towards making attacks more visible.

Areas I'm fuzzy on include torflow data. Mostly because up to a couple weeks ago I didn't know there *was* a spec (and instead treated it as blackbox).

If there are common, and challenging questions, that are more specific than just 'dive in' and explore, please do be creative.

Thanks
--leeroy