> I am fine with implementing either (?[flags]) or (?[flags]:[pattern) or > both.
I'm going to just do the latter then, as it's a simple syntax change from what I currently have, whereas the other is more involved. Vern _______________________________________________ bro-dev mailing list bro-dev@bro.org http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev