> > const tcp_SYN_ack_ok = T &redef; > > > > Perhaps we should just change the default? > > Ah! I should have looked. I didn't even know that about that option. Yeah, I'd forgotten about it too. FWIW, I believe that was added for Bro deployments with high packet loss rates, since they will sometimes miss the initial SYN but not the SYN-ACK. Vern