On 2019 Apr 01 09:40:54, you wrote to me:

 PH> This is not an area of expertise for me but I went looking for info on the
 PH> fstc.org site and found this

that's the current base document, yes...

 PH> [snip]

 PH> There does not seem to be any reference to requiring that NET be displayed
 PH> at the start of each SEEN-BY line

correct... there isn't in there... there's also no mention of the squashed
format where additional nodes in the same net and one the same line drop
the net/ part but we all know that it is done like that...

 PH> - perhaps I should be looking at another reference doc?

i'm not sure which one that would be...

the thing i don't understand is it was working properly before so why did
james ""fix"" it?? ;) ;) ;)

)\/(ark

Always Mount a Scratch Monkey
Do you manage your own servers? If you are not running an IDS/IPS yer doin'
it wrong...
... We are watching, and we are always here.
---