lot of packets - and given 4 seconds elapsed time, this is happening at a pretty modest load, about 6Kpps, even when you're not capturing full packets. That all boils down to this certainly looking like a problem with the packet filter itself rather than Bro. Vern