[Bro] Bro 2.3.2-419 segfaults when using PF_RING 6.0.3 libpcap 1.6.2 and pfdnacluster_master on RHEL 6.6

[Daniel Thayer]

Thanks for reporting this issue.  I've made a small change
to broctl so that it now recognizes the shorter name "dnacl".

-Daniel


On 02/27/2015 10:43 AM, Gary Faulkner wrote:
> As a follow up to the second issue I was seeing. Alfredo (from NTOP)
> suggested that pfdnacluster_master was not allowing me to listen with
> more than 10 app instances possibly due to the name being too long when
> using the long format dnacluster:21 at 10 as opposed to dnacl:21 at 10. Bro
> used to work fine with the long name, so perhaps this is some change in
> PF_RING. Using the short name allowed Bro to bind workers to dnacl:21 at 10
> and greater, but this seems to cause broctl to not call capstats
> properly (for a dnacluster). When using dnacluster:21 'broctl capstats'
> had some logic that would trigger broctl to call a single instance of
> capstats for each worker node as app2 on the dnacluster, where app2 had
> a single queue with a full copy of the traffic, so it wouldn't get a 'no
> such device message'. This doesn't seem to work when using the short
> name version of 'dnacl', and instead broctl calls capstats for each
> individual worker and since these are already bound to the app1 queues
> there is nothing for capstats to listen on.
>
> Regards,
> Gary
>