Hi, Seems like the timestamp in the bro log file come from the system/wall clock. Is there for bro to force it to use the timestamp in the pcap file? Thanks. dk -------------- next part -------------- An HTML attachment was scrubbed... URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20160608/ae6431c6/attachment.html