Hey all, I've been tasked with seeing about getting an alert of some kind when a session (tcp/udp/icmp) lasts longer then a certain time. Is this something well suited for bro, or should I go looking at something like ntop-ng instead? Thank you. James