Hello, Is the timer implementation in bro based on the packet timestamps ? I am trying to understand how bro keeps separate timers for, say, 1000 simultaneous tcp sessions, for example. Any clarification is appreciated. Thanks for any info !