address histogram now (incorrectly) uses iptree; eliminated a lot of redundant raw packet parsing