> I just wanna clarify that , is the backdoor event engine(which does all > the signature detection) eventually invokes the corresponding event > engine and the Analyser . The backdoor analyzer is separate from Bro's signature engine. The analyzer only generates backdoor events - not other signature events, and not protocol parsing events. Vern