many error with bro policy

Zeek
1

Hi, I’ve some problems using bro (offline). When I set a policy on bro to scan a dump file it happens I have this warnings:

/usr/local/bro/policy//scan.bro, line 92: warning: no such host: j5004.inktomisearch.com
/usr/local/bro/policy//scan.bro, line 92: warning: no such host: j5005.inktomisearch.com
/usr/local/bro/policy//scan.bro, line 93: warning: no such host: j5006.inktomisearch.com
/usr/local/bro/policy//scan.bro, line 93: warning: no such host: j100.inktomi.com
/usr/local/bro/policy//scan.bro, line 93: warning: no such host: j101.inktomi.com
/usr/local/bro/policy//scan.bro, line 94: warning: no such host: j3002.inktomi.com
/usr/local/bro/policy//scan.bro, line 94: warning: no such host: si3000.inktomi.com
/usr/local/bro/policy//scan.bro, line 94: warning: no such host: si3001.inktomi.com
/usr/local/bro/policy//scan.bro, line 95: warning: no such host: si3002.inktomi.com
/usr/local/bro/policy//scan.bro, line 95: warning: no such host: si3003.inktomi.com
/usr/local/bro/policy//scan.bro, line 95: warning: no such host: si4000.inktomi.com
/usr/local/bro/policy//scan.bro, line 96: warning: no such host: si4001.inktomi.com
/usr/local/bro/policy//scan.bro, line 96: warning: no such host: si4002.inktomi.com
/usr/local/bro/policy//scan.bro, line 96: warning: no such host: wm3018.inktomi.com

Everytime I have this warnings I have also some errors like:

/usr/local/bro/policy//ftp.bro, line 48: run-time error: error compiling pattern /(^?.(..rhosts))|(^?.(..forward))/

and bro don’t create any log or alarm.
I don’t understand this error. Can you help me?

2

Hi,

Hi, I've some problems using bro (offline). When I set a policy on bro to
scan a dump file it happens I have this warnings:

/usr/local/bro/policy//scan.bro, line 92: warning: no such host:
j5004.inktomisearch.com

[snip]

   These hosts don't exist anymore (well, DNS entries for them seem to
   not exist anymore). I solved it by just commenting those lines
   (anyway it was just a warning saying it couldn't resolve that host).

Everytime I have this warnings I have also some errors like:

/usr/local/bro/policy//ftp.bro, line 48: run-time error: error compiling
pattern /(^?.*(.*\.rhosts))|(^?.*(.*\.forward))/

   I guess Robin already pointed you out to

      http://www.bro-ids.org/wiki/index.php/"Error_compiling_pattern"

   What version of Bro are you using (here, I've Bro-1.2.1 stable on
   GNU/Linux Ubuntu 8.04)?

bye,
Lorenzo