bad tag in Val::CONVERTER

Zeek
1

Hello,

Another error with trying to run the current svn version, 1.3.25. Doing a proper make install fixed the scan.bro error, but now when I start it fails immediately with the following error.

lobo# etc/bro.rc start
bro.rc: Running as non-root user bro
bro.rc: Starting .bro.rc: Failed to start Bro
pcap bufsize = 32768
listening on fxp1
1207590206.353962 (45:1C:A7:1D:CB:BE:82:EC:52:83:01:09:CC:9E:13:ED:D6:9E:7E:5E:C7:A1:8A:77:B3:5E:C3:B0:BB:2F:16:C1): bad tag in Val::CONVERTER (string/table)
… FAILED

I mucked about with gdb for a bit but figured I would just ask. I saw on the wiki that there was a known issue somehwat similar to this, or is it just that I am overlooking something. Let me know if you need other debug logs, etc.

Thanks,
Stephen

2

Iirc, this is a problem with the SSL analyzer. Assuming it is
enabled, can you try not loading ssl.bro?

Robin

3

That took care of it. Incidentally it looks like the libGeoIP function is missing the ntohl() on the address argument again. I'm getting results for inverted addresses.

Thanks,
Stephen

Robin Sommer wrote: