> I have one more question: when Bro detected a Stepping Stone , it show us a > time. Is the time > when Bro see a packet belong to the Chain? It's the time when Bro's algorithm has determined that a stepping stone exists. You could follow the logic in stepping.bro regarding when it generates this output in order to determine this. Vern