> I was wondering why the following code is commented out of smtp.bro? > ... > > in policy/smtp.bro > > 508 # else if ( cmd == "MAIL" && code == 250 ) > 509 # smtp_command_mail(session, cmd_info); Huh, I don't know what's up with that. I've cc'd Ruoming (who I believe wrote the original smtp.bro) in case he recalls. Vern