[Bro] [Fwd: Re: remote.bro]

[Christian Kreibich]

Hi again Sandro,

thanks for the feedback.

On Sun, 2006-10-08 at 23:45 -0700, Christian Kreibich wrote:
>
> I made a diff and both 1.1 config.h were identical.
> Maybe, the problems are caused by VMware? As soon as our wireless-patch 
> for 1.1 is finished, I'll install 1.1 on machine B without using VMware 
> and tell u whether communication works better or not ;-)

So one thing I can think of that you could try is running broping,
Broccoli's communication test tool:
http://www.cl.cam.ac.uk/~cpk25/broccoli/manual/c85.html#AEN701

Basically you configure a Bro node to run a broping policy and then this
node will return "pong" events for every "ping" event the ping client
sends to the node. If the Bro node uses the select loop, this should
definitely work without any live traffic at all. It also takes one Bro
out of the equation, hopefully making it easier to pinpoint the Bro node
causing the problem.

Cheers,
Christian.
-- 
________________________________________________________________________
                                          http://www.cl.cam.ac.uk/~cpk25
                                                    http://www.whoop.org