What is the difference between id.orig_h, id.resp_h and src,dst?
Hi Paul,
src and dst are used if there isn’t a connection id.
source: http://www.bro.org/sphinx-git/scripts/base/frameworks/notice/main.html#type-Notice::Info
Source address, if we don’t have a conn_id.
Destination address.
Not much. 
I think the original intent behind them was that in cases where there is no obvious directionality (i.e. non-tcp) the src and dst fields would be used since they indicate the sender and receiver of an individual packet and don't represent a "connection". I've been using the src field for notices that only reference a single host too although ultimately I don't think that's a good thing. We should probably add a host field for cases where only a single host is being referred to in the notice.
.Seth