> I use "packet load" as : the data of IP packet , or the data of TCP/UDP > packet. Ah - the term you're looking for is "payload". You can get this using the "packet_contents" event handler, or using the new signature engine (for which Robin Sommer has contributed a new chapter for the Bro manual, which will be included in the next development release). Vern