> does bro scripts support bit manipulation ? > for eg: to see if the nth bit is set/not ? Only via mask_addr(), which just lops off least significant bits. Adding some built-in functions to do this would be quite easy, though. Just use mask_addr() as a template for how to do it. Vern