On Feb 11, 2013, at 3:41 PM, Tim Ray <tray at 21ct.com> wrote: > How does Bro handle such a case? Does it understand that such a thing is > corrupt? How was this packet acquired? It sounds like you have a corrupted packet capture. .Seth -- Seth Hall International Computer Science Institute (Bro) because everyone has a network http://www.bro-ids.org/