[Bro] bro hangs

[Diana Zeaiter Joumblatt]

Hi,
I just started using bro for doing traffic analysis. It seems to be hanging for some of the traces and i don't know how to use the -t (timeout) option because the problem might be related to unanswered dns requests.

$bro -r trace.pcap tcp alarm weird

/opt/local/share/bro/policy/scan.bro, line 92: warning: no such host: j5004.inktomisearch.com/opt/local/share/bro/policy/scan.bro, line 92: warning: no such host: j5005.inktomisearch.com/opt/local/share/bro/policy/scan.bro, line 93: warning: no such host: j5006.inktomisearch.com/opt/local/share/bro/policy/scan.bro, line 93: warning: no such host: j100.inktomi.com/opt/local/share/bro/policy/scan.bro, line 93: warning: no such host: j101.inktomi.com/opt/local/share/bro/policy/scan.bro, line 94: warning: no such host: j3002.inktomi.com/opt/local/share/bro/policy/scan.bro, line 94: warning: no such host: si3000.inktomi.com/opt/local/share/bro/policy/scan.bro, line 94: warning: no such host: si3001.inktomi.com/opt/local/share/bro/policy/scan.bro, line 95: warning: no such host: si3002.inktomi.com/opt/local/share/bro/policy/scan.bro, line 95: warning: no such host: si3003.inktomi.com/opt/local/share/bro/policy/scan.bro, line 95: warning: no such host: si4000.inktomi.com/opt/local/share/bro/policy/scan.bro, line 96: warning: no such host: si4001.inktomi.com/opt/local/share/bro/policy/scan.bro, line 96: warning: no such host: si4002.inktomi.com/opt/local/share/bro/policy/scan.bro, line 96: warning: no such host: wm3018.inktomi.comline 1: warning: event handlers never invoked:line 1: warning: 	 account_tried
Thanks for your help,
diana

-- 
Diana Zeaiter Joumblatt
Phd Student
Université Pierre & Marie Curie - LIP6/CNRS
104 Avenue du Président Kennedy
75016 Paris, France
Desk 705
(+33) 01 44 27 87 75


What can you do with the new Windows Live? Find out
What can you do with the new Windows Live? Find out
_________________________________________________________________
Drag n’ drop—Get easy photo sharing with Windows Live™ Photos.

http://www.microsoft.com/windows/windowslive/products/photos.aspx
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20090705/94f5fe9e/attachment.html