> Where can I find more documentation/information about Bro's regular > expression? It's the same as used by the "flex" tool, which is installed on many systems either by that name or as simply "lex". Vern