> Are there any test suites for Bro? PCAP files to read, scripts to run, > and outputs to diff when done? Unfortunately, no. This is on the new "wish list" at: http://www-nrg.ee.lbl.gov/bro-wishlist.html (which the Bro home page now links to) - Vern