64-bit?

Does anyone run Bro build as a 64-bit binary on a 64-bit platform?

Thanks,
  .Seth

I'm running Bro 1.5 on x86_64 Linux. No obvious issues here -- except with
broccoli.

It has been running fine on CentOS 5.3 x86_64 since late 2009.

Tyler

I'm running Bro 1.5 on x86_64 Linux.

Current development version on x86_64 FreeBSD 8.0 here, also with no
apparent problems.

No obvious issues here -- except with broccoli.

What's the broccoli issue? Can you file a tracker ticket for that
please?

Robin

I am as well.. but I haven't had any problems with broccoli.

Ok, that's partly why I asked. It looks like broccoli needs to be built with -fPIC. I'll file a ticket in the tracker.

  .Seth

I built 32- and 64-bit RPM's of bro 1.4 without needing to force -fPIC
anywhere. I haven't had a chance to update them to 1.5 yet, so it's
possible that has changed.

Michael

I encountered underruns and corruption while using bropipe to send
datatypes involving an int (count, port...) to Bro. The underlying issue
seems to be that broccoli is sending a 32-bit int and Bro is expecting a
64-bit one.

In what is probably the Wrong Way(tm) to approach the problem, I patched
broccoli to send 64-bit ints with the high 32 bits zeroed.

Did you have Bro built with --enable-int64?

  .Seth

Seth Hall wrote:

Does anyone run Bro build as a 64-bit binary on a 64-bit platform?

working fine for me. However, I do trace analysis with it without using
broccoli or cluster....

cu
gregor

After some more investigation, here's the ticket:
  http://tracker.icir.org/bro/ticket/256

  .Seth

Initially I did. That seems to be what caused the problem. Rebuilding
without --enable-int64 appears to have resolved the underrun errors in bro.

Yet another ticket needs filed for that one.

  .Seth