[Bro] BroPing Connection Failure

[Robin Sommer]

On Mon, Nov 16, 2009 at 08:29 +0100, Fabian Hugelshofer wrote:

> I read about using --disable-select-loop on  
> http://bro-ids.org/wiki/index.php/User_Manual:_Performance_Tuning. There  
> it sais that Phil Wood's libpcap is buggy in non-blocking mode. 

I see. That's actually pretty old and I don't remember what
specifically the problem was; it might be fixed with newer versions
of Phil's libpcap, don't know. Do you see the high CPU when using a
standard pcap?

The select-based loop was introduced specifically to combine pcap
input with simultaneous remote communication (like via Broccoli);
which is what you're doing it seems. The suggestion in the Wiki is
meant for configurations not involving any communication (even
though it doesn't say so ...), I wouldn't recommend using
--disable-select-loop when doing both as that won't work reliable.

Robin

P.S.: And yes, please try Seth's fix to see that already helps. 

-- 
Robin Sommer * Phone +1 (510) 666-2886 * robin at icir.org 
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org