FYI, the pre-test has been updated to: http://www.icir.org/vern/tmp/bro-1.2.18.tar.gz with the main changes being fixes for ICMP messages that include non-TCP/UDP excerpts, and a BinPAC portability tweak. Vern