> I am using bro 0.7a48 version on openBSD 2.9. First thing to try is the latest alpha snapshot: ftp://ftp.ee.lbl.gov/.vp-bro-pub-0.7a90.tar.gz If it still occurs with that, then see if you can get a version of the problem to reproduce (by capturing the related traffic in a tcpdump save file). Vern