> Here it is a sample... it is just an handshake but if you run > > $bro -r to-brolist_anonym.pcap brolite > > you will see in the conn.log file the BIG computation mistake... Hmmm, this appears to be specific to brolite.bro. If I run on the trace with mt.bro, it flags the sizes as "? ?", which seems fine in this case. We'll look into it further. Vern