> ipsumdump --collate -w *.pcap | $BROHOME/bin/bro -r - brolite mysite That needs to be: ipsumdump --collate -w - *.pcap | $BROHOME/bin/bro -r - brolite mysite Unfortunately as you issued it, ipsumdump wrote the output to the first file in the expansion of *.pcap, overwriting it :-(. Vern