> I've noticed that the alarms are been triggered with a > normal conection to gmail. Do you need the entire trace ? From the > Handshake to the FIN? In general, yes, otherwise Bro isn't going to process it when run off-line. Vern