[Bro] internal error: unknown msg type 101 in Poll()
JAzoff at uamail.albany.edu
Mon Feb 22 13:16:07 PST 2010
On Mon, Feb 22, 2010 at 01:39:45PM -0700, Tyler Schoenke wrote:
> I just tried Seth's suggestions about filtering ContentGap and
> AckAboveHole, and it has been quiet for the last couple hours.
I ran into general load issues when I switched to running a single node
cluster.. I traced it back to the same problem with ContentGap and
AckAboveHole.. I also ignored Weird::WeirdActivity, which helped too.
If I ran capstats on the 'lo' interface, I would see Bro doing about 10mbps and
a few thousand packets/sec for what seemed like no reason. After ignoring
those two event types lo now has under .1 mbps and about 20 packets/sec.
-- Justin Azoff
-- Network Security & Performance Analyst
More information about the Bro