> [or]size is in the endpoint record. I think you may be thinking of the > large-conns.bro script that calculates an upper and lower bound for the > connection size. Yep, exactly. I grepped around for osize/rsize and didn't find it. In fact, I'm still not finding it. So is this an informal term, or am I not looking in the right place? Vern