On Jan 24, 2010, at 11:17 PM, daniela.miao at utoronto.ca wrote: > bro -r test.pcap dns > > I believe this is correct? Yes, that should be correct. Can you share the tracefile? .Seth --- Seth Hall Network Security - Office of the CIO The Ohio State University Phone: 614-292-9721