# Bro Question **URL:** \ **Category:** Zeek\ **Created:** [February 4, 2000, 4:48pm UTC](https://community.zeek.org/t/bro-question/72 "2000-02-04T16:48:52Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\ **Post date:** [February 4, 2000, 4:48pm UTC](https://community.zeek.org/t/bro-question/72/1 "2000-02-04T16:48:52Z")
> I'm using the suggested filter, i.e.: > > ./bro -f "((tcp[13] & 0x7 != 0) or \ > port telnet or tcp port 513 or port finger or port 111 or tcp port 113 or \ > port ftp or dst port 8000 or \ > (tcp and (ip[6:2] & 0x3fff != 0)))" \ > -i hme0 mt > > Looking at the top stats for the system, top gives: > > load averages: 1.00, 1.01, 1.01 00:15:11 > 22 processes: 20 sleeping, 1 running, 1 on cpu > CPU states: 0.0% idle, 99.8% user, 0.2% kernel, 0.0% iowait, 0.0% swap > Memory: 256M real, 76M free, 13M swap in use, 424M swap free > >   PID USERNAME THR PRI NICE SIZE RES STATE TIME CPU COMMAND > 3172 root 1 40 0 4216K 3736K run 22.9H 99.51% bro Very strange. The next thing to do is attach a debugger to it when it's running and see where it is. But you might also want to try the Bro 0.7a10 snapshot:   ftp://ftp.ee.lbl.gov/.vp-bro-pub-0.7a10.tar.gz which may have already fixed the problem (there were some bugs in which certain sequences of packets could make Bro loop or crash). This is a 0.7 pre-release and so doesn't include discussion of what has changed, so not really ready for general use, though others who want to play with it now can go ahead and fetch it. As usual, please don't redistribute it further, instead point people at me for further copies.     Vern ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:36pm UTC](https://community.zeek.org/t/bro-question/72/2 "2022-05-06T15:36:09Z")