[Bro] internal error: unknown msg type 101 in Poll()

Robin Sommer robin at icir.org
Sun Feb 21 10:53:02 PST 2010

On Sat, Feb 20, 2010 at 08:17 -0700, Sean McCreary wrote:

> To check this, I have set up two clusters fed by the same input traffic.

That's is interesting. Thanks for comparing the two setups. I've
seen this problem myself so far only when one of the systems
appeared to be under too much load or crashed for some other reason.
However, in that case it was then *not* the node with the overload
reporting the 101 message, but (I think) always manager or proxy.
Therefore, I've been thinking that this message is the result of
manager/proxy not being able to deal nicely with other nodes having

But it seems in your tests, none of the other systems showed any
kind of unusual behaviour, is that right?

To fix this, I'll need some way of reliably reproducing it. I
haven't actually seen it myself in a while now. I should build some
similar test setup over here I guess.


P.S.: Can you send me remote.logs from your setups, ideally
one with a crash from the first cluster and the other from the
second without a crash, both for (roughly) the same time interval. 

Robin Sommer * Phone +1 (510) 666-2886 * robin at icir.org 
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org

More information about the Bro mailing list