Crash report from bro

Zeek
1

I have been getting the crash report below on a new Bro installation:
Ubuntu Karmic
Bro 1.5.1

This happens whenever broctl cron is run.

Any pointers would be appreciated since I am new to the Bro world, and
have been struggling with the lack of documentation for 1.5.1.

Thanks,
Joe

2

This happens whenever broctl cron is run.

That's only a symptom: "broctl cron" checks whether Bro has crashed;
if so, it mails out the crash report. The crash itself is quite
certainly not triggered by "cron" but has occured earlier.

Program terminated with signal 11, Segmentation fault.
#0 FragTimer::ClearReassembler (this=0x11ae9c70) at Frag.h:62
62 void ClearReassembler() { f = 0; }

Don't know what's causing this but it seems to be related to IP
fragments in some form. Are you able to reproduce this offline from
a trace captured with tcpdump?

Robin

3

I've seen lots of crashes in strange places when my analyzers are severely overworked. Are yours running close to 100% CPU usage? Sometimes it will be difficult to tell though if you see occasional dramatic spikes.

   .Seth

4

I am running on dual Quad-Core AMD Opteron Processor 2378 hardware, and
CPU usage is very low. It is running against a 1GB interface fed from a
1GB buffered feed.

I'll try the use_connection_compressor and see how it goes.

Joe