> Unfortunately I'm not in a position to be able to provide tracefiles on this > particular issue. A pity, as we do have quite a bit of machinery for analyzing performance problems like this. One you could try directly is including profiling.bro (and/or pkt-prof.bro) in your analysis scripts. Vern