[Bro] Bro crashing on start

Drake Aronhalt drakearonhalt at gmail.com
Thu Oct 6 20:01:50 PDT 2016


All,
  This morning I updated bro and pfring on my dev sensor to their
respective git master branches and started receiving this error when I try
to start bro:

# broctl start

starting logger ...

starting manager ...

starting proxy-1 ...

starting worker-1-1 ...

starting worker-1-2 ...

starting worker-1-3 ...

starting worker-1-4 ...

starting worker-1-5 ...

worker-1-5 terminated immediately after starting; check output with "diag"

worker-1-4 terminated immediately after starting; check output with "diag"

worker-1-1 terminated immediately after starting; check output with "diag"

worker-1-3 terminated immediately after starting; check output with "diag"

worker-1-2 terminated immediately after starting; check output with "diag"


running 'broctl diag' gives me this

      fatal error: problem with interface eno33557248 (pcap_error: BPF
program is not valid)



pf_ring is loading properly as far as I can tell. My node.cfg is below:


[logger]

type=logger

host=localhost


[manager]

type=manager

host=localhost


[proxy-1]

type=proxy

host=localhost


[worker-1]

type=worker

host=localhost

interface=eno33557248

lb_method=pf_ring

lb_procs=5

pin_cpus=2,3,4,5,6


Any ideas on what causes this? Should I just roll back to my last config
that worked, or did I miss a change in bro 2.5 config?


Drake
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20161006/e3c63625/attachment.html 


More information about the Bro mailing list