Hi Luis, > Is there any way to glean layer 2 information from bro? Or maybe a reliable > means of correlating IPs to hostnames? Bro 2.5 (beta2 available) will support logging of MAC addresses: https://github.com/bro/bro/blob/master/scripts/site/local.bro#L98 Best regards, Jan