[Bro] BroPing Connection Failure

[Fabian Hugelshofer]

Thanks for the fast response, Robin.

Robin Sommer wrote:
> Sounds like a nasty race condition of some sort. The remote.log only
> shows that something weird is going on but isn't detailed enough to
> understand what's causing it. Please enable debugging output on both
> sides. For Broccoli, see here:
> http://www.icir.org/christian/broccoli/manual/c84.html#AEN814 
> 
> For Bro, configure with --enable-debug and then run with "-B comm".
> That should produce a debug.log with lots of information.

I enabled debugging on the client with "-d -d" (bropingc.txt) and on the 
server with "-B comm" (bropings.txt). I also attached a tcpdump trace of 
the communication.

Even if the server seems to finish the handshake, it doesn't send 
anything back to the client (see tcpdump trace). As a result of that the 
client times out.

I found out that compiling without "--disable-select-loop" doesn't show 
these connection problems. I'm not sure whether this is related or a 
coincidence. I can use this as a workaround, but would prefer another 
solution.

> It would also be good if you could try it with the current
> development version from SVN to see if the problem still occurs with
> that one.

The current development version of Bro 1.5 does still show the same 
behaviour.

Fabian
-------------- next part --------------
A non-text attachment was scrubbed...
Name: bropingc.txt.gz
Type: application/x-gzip
Size: 3037 bytes
Desc: not available
Url : http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20091102/329d671e/attachment.gz 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: bropings.txt.gz
Type: application/x-gzip
Size: 871 bytes
Desc: not available
Url : http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20091102/329d671e/attachment-0001.gz 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: broping.pcap.gz
Type: application/x-gzip
Size: 338 bytes
Desc: not available
Url : http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20091102/329d671e/attachment-0002.gz