When I tried to test Bro in off-line with TCP dump file, I met
segmentation falut error.The tcpdump was captured using "Targa2.c" with all supported attacks.
While I couldn't reproduce the crash using the trace you subsequently sent
me, the heavy use of fragments makes me suspect it's the same fragment bug
that I fixed a few days ago (and will be included in the next release).
I've attached diffs for it in case you want to try directly. Note that
for the trace you sent me, Bro takes a *long* time to process it, since
every packet in it generates multiple events. Fixing this sort of performance
problem is clearly important and on our radar, but it can be quite hard,
so it will remain an issue.
Vern
Index: Frag.cc