On Dec 5, 2012, at 3:05 PM, "Siwek, Jonathan Luke" <jsiwek at illinois.edu> wrote: >> but I don't see one that uses MailFrom to add a "redef Notice::mail_from=…". So I think that's a bug. Arg! Thanks Jon. .Seth -- Seth Hall International Computer Science Institute (Bro) because everyone has a network http://www.bro-ids.org/