> There's always only one pcap filter in use. (Nit: there can be two, if you use Bro's "secondary filter" capability, which is designed to provide a lightweight, additional packet stream to supplement the main analysis.) Vern