On Jul 13, 2011, at 12:47 PM, Robin Sommer wrote: > Is there a well-known port for this protocol? If so, add it to > policy/server-ports.bro and it should work. Eek, good reminder. I need to put that back! .Seth -- Seth Hall International Computer Science Institute (Bro) because everyone has a network http://www.bro-ids.org/