[Bro] Bro 2.3.2-419 segfaults when using PF_RING 6.0.3 libpcap 1.6.2 and pfdnacluster_master on RHEL 6.6

[Gary Faulkner]

As a follow up to the second issue I was seeing. Alfredo (from NTOP) 
suggested that pfdnacluster_master was not allowing me to listen with 
more than 10 app instances possibly due to the name being too long when 
using the long format dnacluster:21 at 10 as opposed to dnacl:21 at 10. Bro 
used to work fine with the long name, so perhaps this is some change in 
PF_RING. Using the short name allowed Bro to bind workers to dnacl:21 at 10 
and greater, but this seems to cause broctl to not call capstats 
properly (for a dnacluster). When using dnacluster:21 'broctl capstats' 
had some logic that would trigger broctl to call a single instance of 
capstats for each worker node as app2 on the dnacluster, where app2 had 
a single queue with a full copy of the traffic, so it wouldn't get a 'no 
such device message'. This doesn't seem to work when using the short 
name version of 'dnacl', and instead broctl calls capstats for each 
individual worker and since these are already bound to the app1 queues 
there is nothing for capstats to listen on.

Regards,
Gary

On Thu, Feb 26, 2015 at 11:13 PM, Gary Faulkner 
<gfaulkner.nsm at gmail.com> wrote:
>> I'm still seeing a separate issue
>> I'm following up with them on concerning not being able to map more than
>> 10 app instances when using libzero's pfdnacluster_master script for
>> load-balancing on host.
>>
>> Regards,
>> Gary
>>
>> On 2/24/2015 2:59 PM, Gary Faulkner wrote:
>>> A couple folks have suggested I run this with gdb and get a backtrace
>>> to post here. Here is a quick gdb session with a backtrace of when I
>>> run bro -i dnacluster:21 at 0:
>>>