# bad tag in Val::CONVERTER

**URL:** <https://community.zeek.org/t/bad-tag-in-val-converter/1313>\
**Category:** Zeek\
**Created:** [April 7, 2008, 6:16pm UTC](https://community.zeek.org/t/bad-tag-in-val-converter/1313 "2008-04-07T18:16:21Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Stephen\_G\_Smith](https://avatars.discourse-cdn.com/v4/letter/s/90db22/32.png) [@Stephen\_G\_Smith](https://community.zeek.org/u/Stephen_G_Smith)\
**Post date:** [April 7, 2008, 6:16pm UTC](https://community.zeek.org/t/bad-tag-in-val-converter/1313/1 "2008-04-07T18:16:21Z")

</div>

Hello,

Another error with trying to run the current svn version, [1.3.25.](http://1.3.25.) Doing a proper make install fixed the scan.bro error, but now when I start it fails immediately with the following error.

lobo# etc/bro.rc start  
bro.rc: Running as non-root user bro  
bro.rc: Starting .bro.rc: Failed to start Bro  
pcap bufsize = 32768  
listening on fxp1  
1207590206.353962 (45:1C:A7:1D:CB:BE:82:EC:52:83:01:09:CC:9E:13:ED:D6:9E:7E:5E:C7:A1:8A:77:B3:5E:C3:B0:BB:2F:16:C1): bad tag in Val::CONVERTER (string/table)  
… FAILED

I mucked about with gdb for a bit but figured I would just ask. I saw on the wiki that there was a known issue somehwat similar to this, or is it just that I am overlooking something. Let me know if you need other debug logs, etc.

Thanks,  
Stephen

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [April 7, 2008, 11:31pm UTC](https://community.zeek.org/t/bad-tag-in-val-converter/1313/2 "2008-04-07T23:31:15Z")

</div>

Iirc, this is a problem with the SSL analyzer. Assuming it is  
enabled, can you try not loading ssl.bro?

Robin

---

<div class="post-metadata">

**Author:** ![Stephen\_G\_Smith](https://avatars.discourse-cdn.com/v4/letter/s/90db22/32.png) [@Stephen\_G\_Smith](https://community.zeek.org/u/Stephen_G_Smith)\
**Post date:** [April 9, 2008, 11:50pm UTC](https://community.zeek.org/t/bad-tag-in-val-converter/1313/3 "2008-04-09T23:50:44Z")

</div>

That took care of it. Incidentally it looks like the libGeoIP function is missing the ntohl() on the address argument again. I'm getting results for inverted addresses.

Thanks,  
Stephen

Robin Sommer wrote:

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/bad-tag-in-val-converter/1313/4 "2022-05-06T15:38:30Z")

</div>