Bro seems to have all the logs except http and dns. If I run a quick tcpdump on my interface for port 80 and 53, I do see event. Anything else I can troubleshoot for? Thanks Monah -------------- next part -------------- An HTML attachment was scrubbed... URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20150518/9056b108/attachment.html