I am using Bro 1.4 stable on Linux and I'm having problems with Broccoli. On one machine with Ubuntu, everything works fine. But on another machine with a custom Linux distribution, I have problems to connect to Bro. The behaviour is not very consistent.
My configure options are --without-openssl --disable-select-loop and --enable-debug.
After compilation, I run in one terminal:
$ src/bro -i eth0 -C aux/broccoli/test/broping.bro
And in a second terminal:
$ aux/broccoli/test/broping -c 1
Most of the time, this fails and the error message is:
"Could not connect to Bro at 127.0.0.1:47758."
The TCP connection however, is fully established, as I can verify with Tcpdump. The client is the one who sends the first FIN to tear the connection down.
Some times, the connection can be established. Attached you find the remote.log of a successful (first) and an unsuccessful attempt. It looks like the handshake could not be completed.
I further tried to debug by running
$ aux/broccoli/test/broping -d -c 1
$ strace aux/broccoli/test/broping -c 1
but in both cases, it was not possible to reproduce the error.
It looks like some kind of race condition. Does anyone have an explanation for this behaviour or a clue about what the cause could be? In case you need more information, just let me know.
remote.log (2.45 KB)