[Bro] NFS.CC code error

[ps sunu]

i am seeing below message in dmesg

bro[1454]: segfault at 7f27ebb17bf8 ip 00007f27ebb17bf8 sp 00007ffc4e9d2ae8
error 15 in libc-2.24.so[7f27ebb17000+2000]


On Fri, Aug 11, 2017 at 11:02 PM, ps sunu <pssunu6 at gmail.com> wrote:

> Hi,
>                        After doing your NFS.CC fix   NFS.bro is going to
> next steps after that i am getting error
>
>
> bro-2.5.1/src/analyzer/protocol/rpc/NFS.cc line no 649
> : RPC_Analyzer("RPC", conn, new NFS_Interp(this))  to  :
> RPC_Analyzer("NFS", conn, new NFS_Interp(this))
>
>
> binu at binu-HP-Pavilion-dv7-Notebook-PC /usr/local/bro/bin $ sudo ./bro -C
> -r /home/binu/Downloads/nfsv3.pcap /home/binu/nfs.bro
> [id=[orig_h=139.25.22.2, orig_p=1022/udp, resp_h=139.25.22.102,
> resp_p=2049/udp], orig=[size=128, state=1, num_pkts=1, num_bytes_ip=156,
> flow_label=0, l2_addr=00:c0:95:e0:19:be], resp=[size=112, state=1,
> num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:c0:95:f8:4d:d3],
> start_time=944207397.4, duration=0.0, service={
> }, history=Dd, uid=CcWDYV1vmfWIGfA3j7, tunnel=<uninitialized>,
> vlan=<uninitialized>, inner_vlan=<uninitialized>, dpd=<uninitialized>,
> conn=<uninitialized>, extract_orig=F, extract_resp=F,
> thresholds=<uninitialized>, dce_rpc=<uninitialized>,
> dce_rpc_state=<uninitialized>, dce_rpc_backing=<uninitialized>,
> dhcp=<uninitialized>, dnp3=<uninitialized>, dns=<uninitialized>,
> dns_state=<uninitialized>, ftp=<uninitialized>, ftp_data_reuse=F,
> ssl=<uninitialized>, http=<uninitialized>, http_state=<uninitialized>,
> irc=<uninitialized>, krb=<uninitialized>, modbus=<uninitialized>,
> mysql=<uninitialized>, ntlm=<uninitialized>, radius=<uninitialized>,
> rdp=<uninitialized>, rfb=<uninitialized>, sip=<uninitialized>,
> sip_state=<uninitialized>, snmp=<uninitialized>, smtp=<uninitialized>,
> smtp_state=<uninitialized>, socks=<uninitialized>, ssh=<uninitialized>,
> syslog=<uninitialized>]
> 944207397.400000 internal error: bad reference count [2]
> Aborted
>
>
> Regards,
> Binu
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20170814/89cb0a2a/attachment.html