[Bro] BroPing Connection Failure

Fabian Hugelshofer fh at open.ch
Fri Oct 30 07:59:00 PDT 2009


Hi all,

I am using Bro 1.4 stable on Linux and I'm  having problems with 
Broccoli. On one machine with Ubuntu, everything works fine. But on 
another machine with a custom Linux distribution, I have problems to 
connect to Bro. The behaviour is not very consistent.

My configure options are --without-openssl --disable-select-loop and 
--enable-debug.

After compilation, I run in one terminal:
$ src/bro -i eth0 -C aux/broccoli/test/broping.bro

And in a second terminal:
$ aux/broccoli/test/broping -c 1

Most of the time, this fails and the error message is:
"Could not connect to Bro at 127.0.0.1:47758."

The TCP connection however, is fully established, as I can verify with 
Tcpdump. The client is the one who sends the first FIN to tear the 
connection down.

Some times, the connection can be established. Attached you find the 
remote.log of a successful (first) and an unsuccessful attempt. It looks 
like the handshake could not be completed.

I further tried to debug by running
$ aux/broccoli/test/broping -d -c 1
or
$ strace aux/broccoli/test/broping -c 1
but in both cases, it was not possible to reproduce the error.

It looks like some kind of race condition. Does anyone have an 
explanation for this behaviour or a clue about what the cause could be? 
In case you need more information, just let me know.

Regards,

Fabian

libc 2.9
libm 2.9
Linux 2.6.26
i686
-------------- next part --------------
A non-text attachment was scrubbed...
Name: remote.log
Type: text/x-log
Size: 2511 bytes
Desc: not available
Url : http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20091030/4b95abfa/attachment.bin 


More information about the Bro mailing list