just a heads-up, Since Bro includes resolver code from the BIND distribution, I believe it will need to pick up patches for the vulnerabilities described in http://www.cert.org/advisories/CA-2002-19.html -Chad