On Sep 8, 2014, at 9:17 AM, David Hoelzer <dhoelzer at sans.org> wrote: > I notice that you say “default behavior”. Is there an enum or constant that I can adjust to change this behavior? Not specifically for this event, but you can generally ignore checksum errors via “redef ignore_checksums=T;” or using the -C command line option. - Jon