[Bro] weird.log help

[Daniel Guerra]

I don’t know your situation but this looks like reordering problem. All tools expect a time order.

Timeout increase might help.

> On 14 Apr 2016, at 22:18, Josh Guild <josh.guild at morphick.com> wrote:
> 
> Howdy all,
> 
> I'm trying to debug some traffic that is coming off an aggregator right now. I was pointed to this helpful set of slides from Vlad on how to troubleshoot and verify a network (https://speakerdeck.com/vladg/bro-deployment-verification-and-troubleshooting <https://speakerdeck.com/vladg/bro-deployment-verification-and-troubleshooting>).
> 
> Looking at the weird.log from a ~2 min pcap on a network with ~6 Gbps throughput, I've noticed these entries in the weird.log (top 10 or so).
> 
> 5454 line_terminated_with_single_CR
> 4012 above_hole_data_without_any_acks
> 2827 TCP_ack_underflow_or_misorder
> 2601 SYN_seq_jump
> 2395 TCP_seq_underflow_or_misorder
> 2192 FIN_advanced_last_seq
> 1330 HTTP_version_mismatch
> 570 bad_HTTP_request
> 333 unescaped_special_URI_char
> 205 window_recision
> 151 dns_unmatched_msg
> 
> Now my questions are these - 1) That seems like a lot of errors for a small sample set but I don't have a reference point for a network of this size. Does anyone else have an equivalent network that they could sanity check for me? 2) Is there a good reference for these weird.log entries that I can look at to try to pin down what is going wrong in the network? I'm particularly interested in the HTTP_version_mismatch and a few other that Vlad mentioned in his presentation. 
> 
> The main reason I'm interested in the details on HTTP_version_mismatch is because I have two pcaps from two separate ports off the aggregator and, for some reason, one is showing as HTTP2 (but only in the OSX version of Wireshark) and Bro can't read pcap properly. The other pcap is read just fine. 
> 
> Sorry for the wall of text but if anyone can point me in the right direction, I'd be much obliged. Thanks!
>  
> 
> -- 
> Josh Guild
> Network Intelligence Analyst
>  <https://twitter.com/stay_spooky>  <https://keybase.io/joshuaguild>
> 
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20160415/23a93e10/attachment.html