[Bro] Bro Continually Crashes

[Mark Buchanan]

It sounds like you don't have an IPv4 address assigned to the interface on
your RHEL/CentOS/Oracle Linux box.  I've solved this in the past by using
"IPADDR=0.0.0.0" and "NETMASK=255.255.255.255" in the
/etc/sysconfig/networking-scripts/ifcfg-eth<N> file.

Does that fix the issue?

Best regards,
Mark

On Mon, Sep 28, 2015 at 1:47 PM, Gabriel Dinkins <gabe at punchcyber.com>
wrote:

> When starting the Bro service, an error stating that Bro terminated
> immediately after start-up continually appears. The following is the info I
> am provided upon running the diag command.
>
>
> ---------------------------------------------------------------------------------------------------------------------------------------
>
> Bro 2.4
> Linux 2.6.32-573.7.1.el6.x86_64
>
>
> ==== No reporter.log
>
> ==== stderr.log
> fatal error: problem with interface p3p1 (p3p1: no IPv4 address assigned)
>
> ==== stdout.log
> max memory size         (kbytes, -m) unlimited
> data seg size           (kbytes, -d) unlimited
> virtual memory          (kbytes, -v) unlimited
> core file size          (blocks, -c) unlimited
>
> ==== .cmdline
> -i p3p1 -U .status -p broctl -p broctl-live -p standalone -p local -p bro
> local.bro broctl broctl/standalone broctl/auto
>
> ==== .env_vars
>
> PATH=/usr/local/bro/bin:/usr/local/bro/share/broctl/scripts:/usr/local/bro/bin:/usr/lib64/qt-3.3/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin
>
> BROPATH=/usr/local/bro/spool/installed-scripts-do-not-touch/site::/usr/local/bro/spool/installed-scripts-do-not-touch/auto:/usr/local/bro/share/bro:/usr/local/bro/share/bro/policy:/usr/local/bro/share/bro/site
> CLUSTER_NODE=
>
> ==== .status
> TERMINATED [atexit]
>
> ==== No prof.log
>
> ==== No packet_filter.log
>
> ==== No loaded_scripts.log
>
>
> ------------------------------------------------------------------------------------------------------------------------------------------
>
> --
> Gabriel Dinkins
> Cyber Security Engineer
> PUNCH Cyber Analytics Group
>
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
>



-- 
Mark Buchanan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20150928/cdbc728c/attachment.html