> On Feb 16, 2017, at 2:36 AM, Izik Birka <Izik.Birka at hot.net.il> wrote: > > Any help ? Bro's strings are purely ascii at this time. You would have to interpret the string as UTF8 in whatever you have receiving logs with. .Seth -- Seth Hall International Computer Science Institute (Bro) because everyone has a network http://www.bro.org/