> I had tried that. Still no luck. Be sure to double-check your setup. I ran your original signature and indeed there was no match, and then made the change to /.*version/ that Robin indicated and it now does indeed match. (no need to include ntp.bro, but it doesn't hurt either) Vern