> One of the things that LANL has started to do after discussions > between Robert and myself while I was out in New Mexico is adding > the raw 160 byte packet into the <What> section as <Params>, e.g. Interesting. Foreign alert encapsulation seems like a good topic to revisit for v2.0. Suspect there is prior art we can benefit from.