[Bro] internal error: unknown msg type 101 in Poll()

[Justin Azoff]

On Mon, Feb 22, 2010 at 01:39:45PM -0700, Tyler Schoenke wrote:
> I just tried Seth's suggestions about filtering ContentGap and
> AckAboveHole, and it has been quiet for the last couple hours. 

I ran into general load issues when I switched to running a single node
cluster.. I traced it back to the same problem with ContentGap and
AckAboveHole.. I also ignored Weird::WeirdActivity, which helped too.

If I ran capstats on the 'lo' interface, I would see Bro doing about 10mbps and
a few thousand packets/sec for what seemed like no reason.  After ignoring
those two event types lo now has under .1 mbps and about 20 packets/sec.

-- 
-- Justin Azoff
-- Network Security & Performance Analyst