On May 12, 2011, at 11:52 AM, Jonathan Siwek wrote: > Looks like the current practice is to declare a type alias in bro.init and then use that alias in the BiF. You got it right. .Seth -- Seth Hall International Computer Science Institute (Bro) because everyone has a network http://www.bro-ids.org/