Hi, When Bro sees an ACK for a packet before the packet itself (packet reordering), it considers that it already delivered the packet to the upper protocols, because it's acked. (see TCP_Contents.cc, line 272). I was wondering whether this is the intended behavior or it's a bug. -Chema