On Jul 22, 2013, at 11:54 AM, Laleh Arshadi <la_arshadi at yahoo.com> wrote: > \now I am looking for the policies upon which Bro decides that a connection is "good", "bad' or "unknown". Hm, your question is a little broad. :) .Seth -- Seth Hall International Computer Science Institute (Bro) because everyone has a network http://www.bro.org/