> I am using version 1.5.1 of bro. The trace I am using is attached as > well as the bro policy file. Thanks for the trace. The problem appears to be that packet counting doesn't work for TCP connections that lack an initial SYN. We have a project right now in considerably extending the analysis framework. So hopefully this will be fixed the next Bro release. Vern