So Stephan, thanks again for the bug report.
You can patch your own copy by making the change in src/bro.bif
< gir = GeoIP_record_by_ipnum(geoip, addr);
---
> gir = GeoIP_record_by_ipnum(geoip, ntohl(addr));
and recompiling.
--
Nicholas C. Weaver nweaver at icsi.berkeley.edu
This message has been ROT-13 encrypted twice for higher security.