Hi, it is possible to write a rule that alerts if i have broadcast traffic - layer 2 - over a fix threshold? Regards, Miso -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20150505/3408ad0a/attachment.html>