[Bro] BroPing Connection Failure
fh at open.ch
Fri Oct 30 07:59:00 PDT 2009
I am using Bro 1.4 stable on Linux and I'm having problems with
Broccoli. On one machine with Ubuntu, everything works fine. But on
another machine with a custom Linux distribution, I have problems to
connect to Bro. The behaviour is not very consistent.
My configure options are --without-openssl --disable-select-loop and
After compilation, I run in one terminal:
$ src/bro -i eth0 -C aux/broccoli/test/broping.bro
And in a second terminal:
$ aux/broccoli/test/broping -c 1
Most of the time, this fails and the error message is:
"Could not connect to Bro at 127.0.0.1:47758."
The TCP connection however, is fully established, as I can verify with
Tcpdump. The client is the one who sends the first FIN to tear the
Some times, the connection can be established. Attached you find the
remote.log of a successful (first) and an unsuccessful attempt. It looks
like the handshake could not be completed.
I further tried to debug by running
$ aux/broccoli/test/broping -d -c 1
$ strace aux/broccoli/test/broping -c 1
but in both cases, it was not possible to reproduce the error.
It looks like some kind of race condition. Does anyone have an
explanation for this behaviour or a clue about what the cause could be?
In case you need more information, just let me know.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 2511 bytes
Desc: not available
Url : http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20091030/4b95abfa/attachment.bin
More information about the Bro