Thanks, that did the trick. -Tyler On 11/12/2009 05:46 AM, Louis F Ruppert wrote: > Mine is set to false here: > > $BROHOME/share/bro/broctl/cluster.dns.bro > > > -Lou > (who also spent some time trying to figure this out) >