[Bro] Lots of dns_unmatched_msg, dns_unmatched_reply in weird.log

Lincy Taylor lc.taylor at protonmail.com
Wed Jan 25 17:23:02 PST 2017

Hello James,

I finally found the root cause with your provided parameters running bro. The error was due to the offloading of checksumming to adapter on my local system while the traffic was captured, which is already mentioned on bro's website[1]. So many thanks for your help!

1. https://www.bro.org/documentation/faq.html#why-isn-t-bro-producing-the-logs-i-expect-a-note-about-checksums


Sent with [ProtonMail](https://protonmail.com) Secure Email.

-------- Original Message --------
Subject: Re: [Bro] Lots of dns_unmatched_msg, dns_unmatched_reply in weird.log
Local Time: 2017年1月25日 8:05 晚上
UTC Time: 2017年1月25日 中午12點05分
From: jlay at slave-tothe-box.net
To: bro at bro.org

On Wed, 2017-01-25 at 03:32 -0500, Lincy Taylor wrote:

Hello all:

I recently found lots of "dns_unmatched_msg" and "dns_unmatched_reply" errors in weird.log of Bro, which likes the following:

1485331604.840044 CSdHx91xFbEKdyo3Pi 40721 53 dns_unmatched_reply - F bro
1485331609.712570 Cw4TXS1DvS49mvRtN4 58915 53 dns_unmatched_reply - F bro
1485331619.101223 CSdHx91xFbEKdyo3Pi 40721 53 dns_unmatched_msg - F bro
1485331619.115208 CGwJfm35oSWSuMdVS6 50308 53 dns_unmatched_reply - F bro
1485331619.115208 Cw4TXS1DvS49mvRtN4 58915 53 dns_unmatched_msg - F bro
1485331619.115208 CGwJfm35oSWSuMdVS6 50308 53 dns_unmatched_msg - F bro

I used tcpdump to create a traffic dump of several dns queries made by dig on ubuntu to and analyzed by "bro -r", the errors are still there in weird.log. The errors seems to be related to an unmatch of query id of query and response messages according to snippet in "share/bro/base/protocols/dns/main.bro". But I found the query ids are consistent with each of DNS query and response by tracing the traffic dump in wireshark.

Has anyone experienced the same issue before?

I attached the log files and pcap file within this message, please help me to find out the root cause. Thank you!

Sent with [ProtonMail](https://protonmail.com) Secure Email.

_______________________________________________ Bro mailing list bro at bro-ids.org http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro

Make sure you set your local net to include the 172 net. As a test on the pcap I ran:

bro -C -r pcaps/dns_8.8.8.8.pcap local "Site::local_nets += { }"

This gets me conn and dns, but no weird log.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20170125/0de8ecb0/attachment.html 

More information about the Bro mailing list