Thanks guys! Justin, if I'm reading this correctly, the script will only look at ports specified in dos_ports. Is there a way to match all ports? Are there dangers in doing that? Tyler -------------- next part -------------- An HTML attachment was scrubbed... URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20140905/bdd4ec17/attachment.html