Bro 57 segfaults

[Vern Paxson]

> I just build and deployed bro-0.8a57 and the thing segfaults after about
> 5-100 minutes of running. I tried '-t file', but then it segfaults
> immediately.
> 
> Platform is RedHat 9; default build of bro with ssl. Deployed on a fairly
> loaded 10MB/s link.
> 
> Anybody else seeing this?

I don't run in that environment, but Robin does (or in something similar),
and I don't believe he's encountered any problems recently.

In general, when reporting a Bro crash, it helps a lot to show a traceback
(not -t output, which is generally much to voluminous to aid in debugging
crashes).  Better (much) still is a tcpdump trace that reprodouces the
problem, if you're able to give me a copy of such.

Note, I recently ran across a problem running Bro's signature engine
against UDP or ICMP traffic.  By default, each new UDP/ICMP flow sticks
around forever, so this rapidly consumes a huge amount of memory.  You
can eliminate the problem via "@load reduce-memory".

		Vern