# ICMP crashing bro

**URL:** <https://community.zeek.org/t/icmp-crashing-bro/4900>\
**Category:** Zeek\
**Created:** [June 13, 2017, 8:02pm UTC](https://community.zeek.org/t/icmp-crashing-bro/4900 "2017-06-13T20:02:54Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Matt\_Clemons](https://avatars.discourse-cdn.com/v4/letter/m/8c91f0/32.png) [@Matt\_Clemons](https://community.zeek.org/u/Matt_Clemons)\
**Post date:** [June 13, 2017, 8:02pm UTC](https://community.zeek.org/t/icmp-crashing-bro/4900/1 "2017-06-13T20:02:54Z")

</div>

Has anyone had issues similar to below? They are crashing one of my workers several times per day. Sifting through PCAP, I don’t see anything unusual.

Checked logs for segfaults, and tried debugging bro with gdb, but that never works for me.

Any insight?

==== stderr.log  
1497373293.094293 analyzer error: unexpected IP proto in ICMP analyzer: 94  
1497373315.914487 analyzer error: unexpected IP proto in ICMP analyzer: 140  
1497376098.060558 analyzer error: unexpected IP proto in ICMP analyzer: 6  
1497376877.285181 analyzer error: unexpected IP proto in ICMP analyzer: 120  
1497377211.129670 analyzer error: unexpected IP proto in ICMP analyzer: 105  
1497377776.944610 analyzer error: unexpected IP proto in ICMP analyzer: 5  
1497378391.755041 analyzer error: unexpected IP proto in ICMP analyzer: 5  
1497379522.608902 analyzer error: unexpected IP proto in ICMP analyzer: 76  
1497380228.950978 analyzer error: unexpected IP proto in ICMP analyzer: 196  
/opt/bro/share/broctl/scripts/run-bro: line 107: 128262 Segmentation fault (core dumped) nohup ${pin\_command} $pin\_cpu “$mybro” “$@”

====messages log

2017-06-12T19:08:08.651585+00:00 hostname kernel: bro[128194]: segfault at de1004a6 ip 00007fb37127d569 sp 00007ffe0e78f830 error 4 in libtcmalloc.so.4.1.0[7fb371259000+47000]  
2017-06-12T19:10:40.117580+00:00 hostname kernel: bro[128192]: segfault at 714226d4 ip 00000000008cd944 sp 00007ffe80937740 error 4 in bro[400000+624000]  
2017-06-12T20:14:42.590509+00:00 hostname kernel: bro[128103]: segfault at 5a4f02a6 ip 00007f6d161c3e6c sp 00007ffdba13e9d0 error 4 in libtcmalloc.so.4.1.0[7f6d161ac000+47000]  
2017-06-13T12:36:24.514458+00:00 hostname kernel: bro[128283]: segfault at c7322eca ip 00007f175f2d5569 sp 00007ffe25199000 error 4 in libtcmalloc.so.4.1.0[7f175f2b1000+47000]  
2017-06-13T12:37:22.767631+00:00 hostname kernel: bro[128279]: segfault at 82fb85c7 ip 00007f4c1a6f9569 sp 00007ffda0594120 error 4 in libtcmalloc.so.4.1.0[7f4c1a6d5000+47000]  
2017-06-13T14:14:33.137432+00:00 hostname kernel: bro[128114]: segfault at b413ac8c ip 00007f4c4d89f569 sp 00007fff1b1267b0 error 4 in libtcmalloc.so.4.1.0[7f4c4d87b000+47000]

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/icmp-crashing-bro/4900/2 "2022-05-06T15:45:03Z")

</div>