[Bro-Dev] #822: Segmentation fault ICMP Analizer

Bro Tracker bro at tracker.bro-ids.org
Tue May 29 09:10:36 PDT 2012

#822: Segmentation fault ICMP Analizer
  Reporter:  Tyler.Schoenke  |      Owner:
      Type:  Problem         |     Status:  new
  Priority:  Normal          |  Milestone:  Bro2.1
 Component:  Bro             |    Version:  git/master
Resolution:                  |   Keywords:

Comment (by robin):

 On Sat, May 26, 2012 at 12:28 -0000, you wrote:

 >  does the ICMP crash all four workers?  Is BPF filtering happening after
 >  the protocol analysis or is it coincidence that four of the 12 src/dst
 >  tuples with the problem all happen to be on the same server?

 We'll look into the crash. Regarding the workers, BPF filtering
 happens before everything else so if the filters are set up as you
 describe, each packet should indeed only arrive at a single worker. So
 it may either be coincidence, or there's something else particular to
 that server that triggers it.


Ticket URL: <http://tracker.bro-ids.org/bro/ticket/822#comment:3>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker

More information about the bro-dev mailing list