[Bro] remote.bro

[Christian Kreibich]

Hi Sandro,

On Sat, 2006-10-07 at 19:21 +0200, Sandro Reichert wrote:
> Hi Christian,
>
> Im using Suse 10.0 on both machines. One Bro1.1 runs on PC 'A', the 
> other on PC 'B' runs on VMware Server, because I started testing with 
> our wireless 0.9a9 edition and we havnt finished the wireless patch
> for 
> 1.1 yet. It should be done within the next days.
> 
> A: Suse 10.0 & Bro 1.1
> B: Suse 10.0 & "Bro-wireless" 0.9a9
>     VMware: Suse 10.0 Bro 1.1

so you have three Bro nodes? My guess is that the 0.9 one is causing the
problem you're seeing.

> The config.h are equal on both machines.

Mhmmm are you sure about this? My guess is that on the 0.9 setup you
need to add --enable-selectloop to the configure invocation. This
ensures that events arriving from a remote Bro are treated with the same
priority as observed packets. You can check whether that is the case by
verifying that USE_SELECT_LOOP is defined in config.h after running
configure.

If the two config.h files really are identical, I don't know what the
problem might be...

Let us know how it goes.

Cheers,
Christian.
-- 
________________________________________________________________________
                                          http://www.cl.cam.ac.uk/~cpk25
                                                    http://www.whoop.org