I just pushed out an expanded take on a ShellShock detector that watches for successful exploitation. https://github.com/broala/bro-shellshock It logs all of the possible attacks over HTTP in http.log too. .Seth -- Seth Hall International Computer Science Institute (Bro) because everyone has a network http://www.bro.org/