# bro segfaults on startup **URL:** \ **Category:** Zeek\ **Created:** [January 10, 2006, 7:41am UTC](https://community.zeek.org/t/bro-segfaults-on-startup/911 "2006-01-10T07:41:33Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\ **Post date:** [January 10, 2006, 7:41am UTC](https://community.zeek.org/t/bro-segfaults-on-startup/911/1 "2006-01-10T07:41:33Z")
What happens if you run it by hand inside gdb? (Also, FWIW, I were to make a wild guess, it would be that this relates to permissions for reading the packet filter.)     Vern ---
**Author:** ![David\_Vasil1](https://avatars.discourse-cdn.com/v4/letter/d/6a8cbe/32.png) [@David\_Vasil1](https://community.zeek.org/u/David_Vasil1)\ **Post date:** [January 10, 2006, 1:55pm UTC](https://community.zeek.org/t/bro-segfaults-on-startup/911/2 "2006-01-10T13:55:00Z")
Vern Paxson wrote: > What happens if you run it by hand inside gdb? > > (Also, FWIW, I were to make a wild guess, it would be that this relates > to permissions for reading the packet filter.) > >     Vern Which packet filter do you mean? Scott Campbell mentioned it may be a problem with the resolver library, as others have had similar problems in the past. Here is the output from strace, ltrace, gdb, ldd, and version information for suspect libraries: [strace -f bin/bro -i eth0 mt http ftp scan] open("/opt/bro/policy/scan.bro", O\_RDONLY) = 9 ioctl(9, SNDCTL\_TMR\_TIMEBASE or TCGETS, 0x7fffffa9a0e0) = -1 ENOTTY (Inappropriate ioctl for device) fstat(9, {st\_mode=S\_IFREG|0644, st\_size=13655, ...}) = 0 mmap(NULL, 4096, PROT\_READ|PROT\_WRITE, MAP\_PRIVATE|MAP\_ANONYMOUS, -1, 0) = 0x2aaaaaab1000 read(9, "# $Id: scan.bro,v 1.11 2005/10/0"..., 8192) = 8192 open(".state/.bro-dns-cache", O\_RDONLY) = -1 ENOENT (No such file or directory) sendto(4, ":\343\1\0\0\1\0\0\0\0\0\0\5j5004\rinktomisearch"..., 41, 0, NULL, 0) = 41 select(5, [4], NULL, NULL, {20, 0}) = 1 (in [4], left {19, 972000}) recvfrom(4, ":\343\201\200\0\1\0\1\0\5\0\5\5j5004\rinktomisearch"..., 1024, 0, {sa\_family=AF\_INET, sin\_port=htons(53), sin\_addr=inet\_addr("160.91.198.66")}, [16]) = 233 --- SIGSEGV (Segmentation fault) @ 0 (0) --- +++ killed by SIGSEGV +++ Process 14764 detached [ltrace -f bin/bro -i eth0 mt http ftp scan] strcmp("/opt/bro/policy/scan.bro", "/opt/bro/policy/scan.bro") = 0 \_Znwm(56, 0x8505a9, 0x709200, 0, 0x36b062f778) = 0x8f3dc0 malloc(80) = 0x8f3e00 strncpy(0x705a60, "\t", 127) = 0x705a60 strncpy(0x705a60, "# who knows why we see these, bu"..., 127) = 0x705a60 strncpy(0x705a60, "\n", 127) = 0x705a60 strncpy(0x705a60, "\t", 127) = 0x705a60 strncpy(0x705a60, "j5004.inktomisearch.com", 127) = 0x705a60 strlen(".state") = 6 \_Znam(70, 0x8ded1e, 0xfeff64736073722d, 25972, 0xfefefefefefefeff) = 0x8f3e60 sprintf("\001\200\255\373\377\177", "") = 21 fopen(".state/.bro-dns-cache", "r") = 0 strlen("dns\_mapping\_valid") = 17 strlen("dns\_mapping\_unverified") = 22 strlen("dns\_mapping\_new\_name") = 20 strlen("dns\_mapping\_lost\_name") = 21 strlen("dns\_mapping\_name\_changed") = 24 strlen("dns\_mapping\_altered") = 19 strcmp("GLOBAL", "GLOBAL") = 0 \_ZNSsC1EPKcRKSaIcE(0x7fffffe91690, 0x571e25, 0x7fffffe91600, 0, 0x89d780) = 0x8f26c8 \_ZNSsC1EPKcRKSaIcE(0x7fffffe91600, 0x8f26c8, 0x7fffffe915f0, 0, 0xfefefefefefefeff) = 0x8f3ec8 strlen("::") = 2 \_ZNKSs5rfindEPKcmm(0x7fffffe91600, 0x5724c1, -1, 2, 0x36b062f6f8) = -1 \_ZNSsC1EPKcRKSaIcE(0x7fffffe91680, 0x567aeb, 0x7fffffe915f0, 1, -2) = 0x8f3ef8 \_ZN9\_\_gnu\_cxx18\_\_exchange\_and\_addEPVii(0x8f3ec0, 0xffffffff, 6, 0, 0x36b062f6f8) = 0 \_ZNSs4\_Rep10\_M\_destroyERKSaIcE(0x8f3eb0, 0x7fffffe915f0, 6, 0, 0x36b062f6f8) = 0x36b062f640 \_ZNKSs7compareEPKc(0x7fffffe91680, 0x567aeb, 0, 4, 0x36b062f6f8) = 0 strlen("dns\_mapping") = 11 \_ZN9\_\_gnu\_cxx18\_\_exchange\_and\_addEPVii(0x8f3ef0, 0xffffffff, 274, 0, 0x73cbc0) = 0 \_ZNSs4\_Rep10\_M\_destroyERKSaIcE(0x8f3ee0, 0x7fffffe91640, 274, 0, 0x73cbc0) = 0x36b062f640 \_ZN9\_\_gnu\_cxx18\_\_exchange\_and\_addEPVii(0x8f26c0, 0xffffffff, 0x8f3ea0, 4, 0x73cbc0) = 0 \_ZNSs4\_Rep10\_M\_destroyERKSaIcE(0x8f26b0, 0x7fffffe91640, 0x8f3ea0, 4, 0x73cbc0) = 0x36b062f640 strlen("j5004.inktomisearch.com") = 23 \_Znwm(16, 0x8ded1e, 6, 0, 0) = 0x8f3f10 \_Znam(24, 41185, 0x36b062f620, -25, 0x36b062f6f8) = 0x8f3f30 strcpy(0x8f3f30, "j5004.inktomisearch.com") = 0x8f3f30 malloc(1064) = 0x8f3f50 memset(0x8f3f50, '\000', 1064) = 0x8f3f50 strncpy(0x8f3f58, "j5004.inktomisearch.com", 1026) = 0x8f3f58 \_\_res\_mkquery(0, 0x8f3f30, 1, 1, 0) = 41 send(4, 0x7fffffe90fd0, 41, 0, 32) = 41 select(5, 0x7fffffe91660, 0, 0, 0x7fffffe91650) = 1 recvfrom(4, 0x7fffffe910d0, 1024, 0, 0x7fffffe914d0) = 233 --- SIGSEGV (Segmentation fault) --- +++ killed by SIGSEGV +++ [gdb bin/bro] (gdb) run -i eth0 mt http ftp scan Starting program: /opt/bro-1.0/bin/bro -i eth0 mt http ftp scan Program received signal SIGSEGV, Segmentation fault. 0x0000000000561ef5 in \_\_ns\_initparse () (gdb) bt #0 0x0000000000561ef5 in \_\_ns\_initparse () Cannot access memory at address 0xffd2a510 [rpm -qif /lib64/libresolv-2.3.4.so] Name : glibc Relocations: (not relocatable) Version : 2.3.4 Vendor: Red Hat, Inc. Release : 2.13 Build Date: Fri 19 Aug 2005 08:34:11 PM EDT Install Date: Thu 10 Nov 2005 05:53:07 PM EST Build Host: crowe.devel.redhat.com Group : System Environment/Libraries Source RPM: glibc-2.3.4-2.13.src.rpm Size : 11474270 License: LGPL Signature : DSA/SHA1, Wed 21 Sep 2005 11:48:40 AM EDT, Key ID 219180cddb42a60e Packager : Red Hat, Inc. \<[http://bugzilla.redhat.com/bugzilla>](http://bugzilla.redhat.com/bugzilla>); Summary : The GNU libc libraries. Description : The glibc package contains standard libraries which are used by multiple programs on the system. In order to save disk space and memory, as well as to make upgrading easier, common system code is kept in one place and shared between programs. This particular package contains the most important sets of shared libraries: the standard C library and the standard math library. Without these two libraries, a Linux system will not function. [ldd bin/bro]   libresolv.so.2 =\> /lib64/libresolv.so.2 (0x00000036b0f00000)   libz.so.1 =\> /usr/lib64/libz.so.1 (0x00000036b0b00000)   libssl.so.4 =\> /lib64/libssl.so.4 (0x00000036a9a00000)   libcrypto.so.4 =\> /lib64/libcrypto.so.4 (0x00000036a9700000)   libtermcap.so.2 =\> /lib64/libtermcap.so.2 (0x00000036b1900000)   libstdc++.so.6 =\> /usr/lib64/libstdc++.so.6 (0x00000036b2800000)   libm.so.6 =\> /lib64/tls/libm.so.6 (0x00000036b0900000)   libgcc\_s.so.1 =\> /lib64/libgcc\_s.so.1 (0x00000036b2600000)   libc.so.6 =\> /lib64/tls/libc.so.6 (0x00000036b0400000)   libgssapi\_krb5.so.2 =\> /usr/lib64/libgssapi\_krb5.so.2 (0x00000036b1b00000)   libkrb5.so.3 =\> /usr/lib64/libkrb5.so.3 (0x00000036b1f00000)   libcom\_err.so.2 =\> /lib64/libcom\_err.so.2 (0x00000036b1500000)   libk5crypto.so.3 =\> /usr/lib64/libk5crypto.so.3 (0x00000036b1d00000)   libdl.so.2 =\> /lib64/libdl.so.2 (0x00000036b0700000)   /lib64/ld-linux-x86-64.so.2 (0x00000036b0200000) Sorry for the long post, please let me know if I can provide any further information. Thank you for your help. ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:37pm UTC](https://community.zeek.org/t/bro-segfaults-on-startup/911/3 "2022-05-06T15:37:46Z")