[Bro] binpac exception: out_of_bound: SSLRecord:rec: 41702 > 1350

Johanna Amann johanna at icir.org
Tue Apr 17 09:20:11 PDT 2018


Hi Fatema,

the answer is that you should not see this happen very often. Let me check
if that is something that I can also observe in our local cluster - the
last time I checked things looked more or less normal.

Johanna

On Tue, Apr 17, 2018 at 09:11:38AM -0400, fatema bannatwala wrote:
> Hi Everyone,
> 
> Looking at weird.log file recently showed a lot of weird notices logged for
> the bicpac exception: out_of_bound, specifically for SSLRecord.
> Hence wanted to ask if these can be safely ignored, or if anything is
> broken and there are some serious issues with the traffic Bro is seeing. :)
> 
> Here are some of the notices from weird.log:
> 
> 2018-04-17T09:01:56-0400        CyVf0j1M4RughxzHt4      128.4.61.1
> 52113   64.15.123.22    443     binpac exception: out_of_bound:
> SSLRecord:rec: 48205 > 1350     -       F       worker-3-6
> 2018-04-17T09:01:56-0400        CyVf0j1M4RughxzHt4      128.4.61.1
> 52113   64.15.123.22    443     binpac exception: out_of_bound:
> SSLRecord:rec: 36586 > 1350     -       F       worker-3-6
> 2018-04-17T09:02:02-0400        CZlYI32EvsHn4OX81l      128.175.252.224
> 54493   64.15.123.22    443     binpac exception: out_of_bound:
> SSLRecord:rec: 17689 > 1350     -       F       worker-3-7
> 2018-04-17T09:02:02-0400        CZlYI32EvsHn4OX81l      128.175.252.224
> 54493   64.15.123.22    443     binpac exception: out_of_bound:
> SSLRecord:rec: 34801 > 1350     -       F       worker-3-7
> 2018-04-17T09:02:03-0400        Cxl308dWBQAhdAuvf       128.4.95.167
> 61457   64.15.123.23    443     binpac exception: out_of_bound:
> SSLRecord:rec: 63514 > 1350     -       F       worker-1-1
> 2018-04-17T09:02:03-0400        Cxl308dWBQAhdAuvf       128.4.95.167
> 61457   64.15.123.23    443     binpac exception: out_of_bound:
> SSLRecord:rec: 4143 > 1350      -       F       worker-1-1
> 2018-04-17T09:02:16-0400        Cn3rHuB9LlM3YfTd1       128.4.62.54
>  65054   173.194.205.189 443     binpac exception: out_of_bound:
> SSLRecord:rec: 13126 > 1350     -       F       worker-2-19
> 2018-04-17T09:02:16-0400        Cn3rHuB9LlM3YfTd1       128.4.62.54
>  65054   173.194.205.189 443     binpac exception: out_of_bound:
> SSLRecord:rec: 13126 > 1261     -       F       worker-2-19
> 2018-04-17T09:02:16-0400        Cn3rHuB9LlM3YfTd1       128.4.62.54
>  65054   173.194.205.189 443     binpac exception: out_of_bound:
> SSLRecord:rec: 63719 > 41       -       F       worker-2-19
> 2018-04-17T09:02:16-0400        Cn3rHuB9LlM3YfTd1       128.4.62.54
>  65054   173.194.205.189 443     binpac exception: out_of_bound:
> SSLRecord:rec: 17744 > 35       -       F       worker-2-19
> 2018-04-17T09:02:17-0400        Cn3rHuB9LlM3YfTd1       128.4.62.54
>  65054   173.194.205.189 443     binpac exception: out_of_bound:
> SSLRecord:rec: 64155 > 38       -       F       worker-2-19
> 2018-04-17T09:02:17-0400        Cn3rHuB9LlM3YfTd1       128.4.62.54
>  65054   173.194.205.189 443     binpac exception: out_of_bound:
> SSLRecord:rec: 54546 > 41       -       F       worker-2-19
> 
> Appreciate any insights. :)
> 
> Thanks!
> Fatema.

> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro



More information about the Bro mailing list