Has anyone had issues similar to below? They are crashing one of my workers several times per day. Sifting through PCAP, I don’t see anything unusual.
Checked logs for segfaults, and tried debugging bro with gdb, but that never works for me.
Any insight?
==== stderr.log
1497373293.094293 analyzer error: unexpected IP proto in ICMP analyzer: 94
1497373315.914487 analyzer error: unexpected IP proto in ICMP analyzer: 140
1497376098.060558 analyzer error: unexpected IP proto in ICMP analyzer: 6
1497376877.285181 analyzer error: unexpected IP proto in ICMP analyzer: 120
1497377211.129670 analyzer error: unexpected IP proto in ICMP analyzer: 105
1497377776.944610 analyzer error: unexpected IP proto in ICMP analyzer: 5
1497378391.755041 analyzer error: unexpected IP proto in ICMP analyzer: 5
1497379522.608902 analyzer error: unexpected IP proto in ICMP analyzer: 76
1497380228.950978 analyzer error: unexpected IP proto in ICMP analyzer: 196
/opt/bro/share/broctl/scripts/run-bro: line 107: 128262 Segmentation fault (core dumped) nohup ${pin_command} $pin_cpu “$mybro” “$@”
====messages log
2017-06-12T19:08:08.651585+00:00 hostname kernel: bro[128194]: segfault at de1004a6 ip 00007fb37127d569 sp 00007ffe0e78f830 error 4 in libtcmalloc.so.4.1.0[7fb371259000+47000]
2017-06-12T19:10:40.117580+00:00 hostname kernel: bro[128192]: segfault at 714226d4 ip 00000000008cd944 sp 00007ffe80937740 error 4 in bro[400000+624000]
2017-06-12T20:14:42.590509+00:00 hostname kernel: bro[128103]: segfault at 5a4f02a6 ip 00007f6d161c3e6c sp 00007ffdba13e9d0 error 4 in libtcmalloc.so.4.1.0[7f6d161ac000+47000]
2017-06-13T12:36:24.514458+00:00 hostname kernel: bro[128283]: segfault at c7322eca ip 00007f175f2d5569 sp 00007ffe25199000 error 4 in libtcmalloc.so.4.1.0[7f175f2b1000+47000]
2017-06-13T12:37:22.767631+00:00 hostname kernel: bro[128279]: segfault at 82fb85c7 ip 00007f4c1a6f9569 sp 00007ffda0594120 error 4 in libtcmalloc.so.4.1.0[7f4c1a6d5000+47000]
2017-06-13T14:14:33.137432+00:00 hostname kernel: bro[128114]: segfault at b413ac8c ip 00007f4c4d89f569 sp 00007fff1b1267b0 error 4 in libtcmalloc.so.4.1.0[7f4c4d87b000+47000]