When I run Bro 2.0 with just the script "protocols/dns", it pulls in (among other things) frameworks/packet-filter/netstats.bro , which strikes me as definitely something optional rather than necessary. If I wanted to suppress that behavior, how would I do it? Vern