> ignore the checksum errors, since now it's giving me an "unrecognized > character" error. That usually means you left off a -r running against a trace, like bro foo.trace http-request rather than bro -r foo.trace http-request Bro is then trying to parse foo.trace as a script and the low-level scanner flags an impossible (8-bit) character. Vern