So Stephan, thanks again for the bug report. You can patch your own copy by making the change in src/bro.bif < gir = GeoIP_record_by_ipnum(geoip, addr); --- > gir = GeoIP_record_by_ipnum(geoip, ntohl(addr)); and recompiling. -- Nicholas C. Weaver nweaver at icsi.berkeley.edu This message has been ROT-13 encrypted twice for higher security.