I wonder if anyone can offer any advice in relation to an issue we have using Zeek (LTS 4.0.3), and a Myricom 10G-PCIE2-8C2-2S. The Myricom card is currently on a SPAN port from a Juniper QFX, albeit we’re planning to move to a Profitap fibre TAP soon.
We’ve compiled Zeek using sources in order to accommodate the snf driver (e.g ./configure --with-pcap=/opt/snf/), and it works well using the following node.cfg configuration -
Our issue, is that when we try to filter traffic, either using ZeekArgs, or redef PacketFilter::default_capture_filter, workers crash within a few minutes of starting the process.
We’re trying to use a simple capture filter like -
ZeekArgs = -f "not dst host 10.100.48.5 and not dst host 10.100.40.78”
redef PacketFilter::default_capture_filter = "not host 10.100.48.5";
The output of the crash diag is attached, but in short, we experience -
Program terminated with signal SIGSEGV, Segmentation fault.
#0 zeek::packet_analysis::Ethernet::EthernetAnalyzer::AnalyzePacket (this=0x5560e04be680, len=808, data=0x41d853675b0719a8 <error: Cannot access memory at address 0x41d853675b0719a8>, packet=0x5560e171b9c8) at /root/zeek-4.0.3/src/packet_analysis/protocol/ethernet/Ethernet.cc:33
33 if ( data == 0x89 && data == 0x03 )
[Current thread is 1 (Thread 0x7f90ea7172c0 (LWP 4830))]
If we remove the BPF or capture filter, the processes stay online consistently.
Any advise on how to diagnose this would be greatly appreciated.
crash-diag.txt (23.3 KB)