OK correct me if I am wrong but snort, or barnyard, would have to copy the full packet into the database, right? This is not a lack in Base or am I missing something?
Sean Muller CCNP CCDP GAWN
"Do or do not... there is no try." Yoda