[Bro] Bro and OpenBSD 4.0 issues

Tim Fowler vze2p5vq at verizon.net
Mon Dec 4 22:58:16 PST 2006

Hello Mr. Luiggi, 

I have already posted the config.log file.  However, I have attached the
Makefile and another file called info.txt.  After running configure and
make, I ran the make install command and redirected the output to info.txt.
I'm just an end user and I have no coding skills at all.  Although, I do
have access to some very good coding folks so if there is something I can
pass on to them to help out, please let me know.


Tim Fowler

-----Original Message-----
From: bro-bounces at ICSI.Berkeley.EDU [mailto:bro-bounces at ICSI.Berkeley.EDU]
On Behalf Of bro-request at ICSI.Berkeley.EDU
Sent: Monday, December 04, 2006 3:00 PM
To: bro at ICSI.Berkeley.EDU
Subject: Bro Digest, Vol 8, Issue 6

Send Bro mailing list submissions to
	bro at ICSI.Berkeley.EDU

To subscribe or unsubscribe via the World Wide Web, visit
or, via email, send a message with subject or body 'help' to
	bro-request at ICSI.Berkeley.EDU

You can reach the person managing the list at
	bro-owner at ICSI.Berkeley.EDU

When replying, please edit your Subject line so it is more specific
than "Re: Contents of Bro digest..."

Today's Topics:

   1. Re: Bro and OpenBSD 4.0 issues (Jean-Philippe Luiggi)
   2. Re: tcp_attempt_delay (Robin Sommer)
   3. Re: Strange Bro build problem with yacc/bison (frenzy at frenzy.org)


Message: 1
Date: Mon, 04 Dec 2006 13:36:26 -0500
From: Jean-Philippe Luiggi <jp.luiggi at free.fr>
Subject: Re: [Bro] Bro and OpenBSD 4.0 issues
To: Tim Fowler <vze2p5vq at verizon.net>
Cc: bro at ICSI.Berkeley.EDU
Message-ID: <20061204183626.GA1520 at armada.mynetwork.local>
Content-Type: text/plain; charset=us-ascii

Hello Tim,

Beside of the fact you run the "base" OpenBSD 4.0 and myself the
development's version, i can't figure out (yet) where's the problem.

In didn't notice in the files you  sent (but i may be wrong) the result of
the "make".
Could you send it please ?

Best regards.

On Sun, Dec 03, 2006 at 10:14:24PM -0500, Tim Fowler wrote:
> Hello Christian, 
> How are you?  I really appreciate the response back.  I have attached the
> config.log from my last attempted build, which I used the "make" program
> that came default with the base install.  I tried it again with "gmake"
> received the same errors.  In regards to the build I use, here are the
> packages I use:
> OpenBSD 4.0 
> bsd, bsd.rd, base40.tgz, comp40.tgz, etc40.tgz, man40.tgz, misc40.tgz
> Updates
> 1. I install the latest version of libpcap.
> Thank you,
> Tim Fowler


Message: 2
Date: Mon, 4 Dec 2006 10:39:06 -0800
From: Robin Sommer <robin at icir.org>
Subject: Re: [Bro] tcp_attempt_delay
To: Jim Mellander <jmellander at lbl.gov>
Cc: bro at ICSI.Berkeley.EDU
Message-ID: <20061204183906.GA23358 at icir.org>
Content-Type: text/plain; charset=us-ascii

On Fri, Dec 01, 2006 at 16:27 -0800, Jim Mellander wrote:

> On an older version of Bro, the new_connection event was triggered
> immediately on receipt of the first packet, and the 'catch-and-release'
> mechanism worked correctly, now we seem to have this 5 second delay.

This might be an (unintentional) artifact of the connection
compressor. I'll look into it.


Robin Sommer * Phone +1 (510) 931-5555 * robin at icir.org 
LBNL/ICSI    * Fax   +1 (510) 666-2956 *   www.icir.org


Message: 3
Date: Mon, 4 Dec 2006 11:44:47 -0700 (MST)
From: frenzy at frenzy.org
Subject: Re: [Bro] Strange Bro build problem with yacc/bison
To: bro at ICSI.Berkeley.EDU
Message-ID: <Pine.LNX.4.44.0612041059580.16234-100000 at frenzy.org>
Content-Type: TEXT/PLAIN; charset=US-ASCII

I am getting this on a FreeBSD 5.4 system also. It seems that
make_parser.pl is not getting called to interpret the parse.y file.
If I run 'make_parser.pl byacc' manually, then the build completes.

It's been awhile since I've played with autoconf/automake.

The conflict appears to be somewhere in the following two entries:

broparse.h parse.cc: parse.y
        $(YACC) $(YFLAGS) parse.y
        @sed '/extern char.*getenv/d;s/yylex/brolex/' <y.tab.c >parse.cc
        @mv y.tab.h broparse.h
        @rm y.tab.c

parse.y: parse.in make_parser.pl
        @rm -f parse.y
        perl -w $(srcdir)/make_parser.pl "$(YACC)"
        chmod -w parse.y



On Sat, 2 Dec 2006, Christian Kreibich wrote:

> On Fri, 2006-12-01 at 18:39 -0800, Vern Paxson wrote:
>> Yeah, we ran into this on a FreeBSD 6.1 machine too.  It wasn't clear
>> at the time whether it was a general 6.1 problem or unique to our 
>> I guess now we know :-).
>> I'm not sure what's the right autoconf goop to solve this - certainly
>> the current build failure isn't pretty.
> Such files should go into MOSTLYCLEANFILES. Try this:
> Index: Makefile.am
> ===================================================================
> --- Makefile.am (revision 3857)
> +++ Makefile.am (working copy)
> @@ -54,6 +54,10 @@
>        portmap-protocol.pac portmap-analyzer.pac \
>        rpc-protocol.pac rpc-analyzer.pac
> +       bif_parse.h bif_parse.cc broparse.h parse.cc \
> +       re-parse.h re-parse.cc rule-parse.h rule-parse.cc
> +
> # this is better
> dns_srcs = nb_dns.c
> @@ -161,8 +165,7 @@
> # Files created in the src dir.
>                   $(BIF_NETVAR_H) $(BIF_NETVAR_DEF) $(BIF_NETVAR_INIT) \
> -                  $(BRO_BIF) \
> -                  $(BINPAC_H) $(BINPAC_CC) \
> +                  $(BRO_BIF) $(BINPAC_H) $(BINPAC_CC) $(YACC_OUTPUT) \
>                   $(DISTCLEANFILES)
> Cheers,
> Christian.
> --
> ________________________________________________________________________
>                                          http://www.cl.cam.ac.uk/~cpk25
>                                                    http://www.whoop.org
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro


Bro mailing list
Bro at ICSI.Berkeley.EDU

End of Bro Digest, Vol 8, Issue 6
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: info.txt
Url: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20061205/24c31234/attachment.txt 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Makefile
Type: application/octet-stream
Size: 22317 bytes
Desc: not available
Url : http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20061205/24c31234/attachment.obj 

More information about the Bro mailing list