On Thu, Dec 11, 2008 at 14:34 -0500, Adayadil Thomas wrote: > Is the timer implementation in bro based on the packet timestamps ? Yes, right. (That's generally true for Bro's notion of time; the "network time" is advanced as packets are processed). Robin -- Robin Sommer * Phone +1 (510) 666-2886 * robin at icir.org ICSI/LBNL * Fax +1 (510) 666-2956 * www.icir.org