Thanks Vern for your help
As suggested, we've tried :
bro -i eth0 -w bro.dump -f "(tcp[13] & 0x7 != 0) or tcp port telnet or tcp
port finger or tcp port ftp or port 111" ../policy/mt.bro >> bro.out 2>>
bro.err
But unfortunately it didn't help.
The only difference is that it take a bit longer before crashing.
If you want, we will send you with another mail the compressed dump
file (3Mb).
Alexandre Dumortier
Patrick Verstraete
UCL, Belgium
This is the 'ps' output taken every 10 minutes since Bro has started:
Wed May 5 11:50:01 CEST 1999
100100 0 9775 1 12 5 7800 7256 R N p0 0:20 bro
-i et
Wed May 5 12:00:00 CEST 1999
100100 0 9775 1 10 5 16188 15644 R N p0 0:50 bro
-i et
Wed May 5 12:10:00 CEST 1999
100100 0 9775 1 10 5 24244 23708 R N p0 1:20 bro
-i et
Wed May 5 12:20:00 CEST 1999
100100 0 9775 1 10 5 32624 32088 R N ? 1:50 bro
-i et
Wed May 5 12:30:00 CEST 1999
100100 0 9775 1 12 5 40348 39812 R N ? 2:19 bro
-i et
Wed May 5 12:40:00 CEST 1999
100100 0 9775 1 12 5 46248 45712 R N ? 2:45 bro
-i et
Wed May 5 12:50:00 CEST 1999
100100 0 9775 1 11 5 53040 52504 R N ? 3:10 bro
-i et
Wed May 5 13:00:02 CEST 1999
100100 0 9775 1 13 5 59320 58784 R N ? 3:30 bro
-i et
Wed May 5 13:10:04 CEST 1999
100100 0 9775 1 9 5 66356 58788 R N ? 3:51 bro
-i et
Wed May 5 13:20:03 CEST 1999
100100 0 9775 1 13 5 72412 58052 R N ? 4:12 bro
-i et
Wed May 5 13:30:08 CEST 1999
100100 0 9775 1 11 5 79700 58908 wait_on_pag D N ? 4:35 bro
-i et
Wed May 5 13:40:09 CEST 1999
100100 0 9775 1 11 5 86904 58608 wait_on_pag D N ? 4:59 bro
-i et
Wed May 5 13:50:11 CEST 1999
100100 0 9775 1 9 5 94572 58756 wait_on_pag D N ? 5:24 bro
-i et
At this point, Bro crashed