double logging :(

["Dorwin T. Shields, Jr." <dorwin () earthlink net>]

Hi,

I'm attempting to capture s mtp sessions in snort.
I capture to a binary file for efficiency then replay into
snort using options -de -r <file> -c <config>.

My config file has only a few rules (if memory serves):
  frag2
  stream4: timeout 60
  stream4_reassembly: client only
  log tcp any any -> any 25 (session: printable;)

I limit to port 25 during the capture.

Every session file I get is twice as large as it should be. It looks
like everything is doubled. Is it something I'm doing or is
this broken? Also, I tried using version 1.9.1 and it did the same thing
on both linux and windows.

Thanks,

Dorwin