Bro Question

[Vern Paxson]

> I am a student a Harvey Mudd College and I am working with a research
> clinic sponsored by the Aerospace Corporation.  I'm currently 
> working on configuring Bro alpha 0.6 under Solaris 2.7.  When I start
> running it, it appears to be working for a while, but eventually
> (sometime between 25min and about a day) it runs away, takes up the whole
> cpu on an Ultra Sparc 30 with 256 megs of RAM,  and never seems to write
> to any of its logs again.

What volume traffic stream are you running it on, and with what tcpdump
filter?  The symptoms sound like it is running out of virtual memory and
starting to page-fault thrash.

		Vern