[Bro] bad_tcp_checksum
Yohann THOMAS
yohann.thomas at rd.francetelecom.com
Sun Jan 16 23:33:44 PST 2005
Hi everybody,
I've been using Bro on my computer on different purposes for a few
months and till now, it always worked well ;-)
Unfortunately, I'm experiencing a problem for a few days.
In fact, when running Bro (with http.bro script) on some other
computers, I have series of "bad_tcp_checksum" (with Linux) or
"bad_ip_checksum" (with FreeBSD), and only a few packets seems to be
read correctly.
To sum up, here is the current situation :
->Bro still works on my computer (Linux Debian, Kernel 2.4.26 - Bro 0.8a87)
->I have "bad_tcp_checksum" or "bad_ip_checksum" in these (tested) cases
(on 3 other computers) :
1.Bro 0.8a87, 0.8a88, 0.9a7 on Linux Debian Kernel 2.6.8 and 2.4.26,
installed with the same mirrors (same versions of libpcap in particular)
2.Bro 0.8a37 (package) on FreeBSD 5.3
(Experiments were done on an operational network, but also directly
between two computers with a crossover cable)
If it can be of interest (I don't really know why, but...), my computer
has an
AMD PCnet32 ethernet controller. Bad checksums where obtained with Intel
and
Broadcom controllers.
Hum... Any ideas are welcome... ;-)
Thanks by advance,
Yohann.
More information about the Bro
mailing list