On Mar 27, 2012, at 4:42 AM, Qinwen Hu wrote: > is anyone know how to solve this problem? You need to supply the pcap formatted trace file with the "-r" flag. bro -r alert1 local .Seth -- Seth Hall International Computer Science Institute (Bro) because everyone has a network http://www.bro-ids.org/