segmentation fault on first packet

Zeek
1

I'm having trouble running bro 1.4 that I recently installed on a solaris computer (uname -a
gives: SunOS fsm04 5.9 Generic_118558-39 sun4u sparc SUNW,Sun-Fire-V890). I've installed and
run bro on linux boxes several times over the last couple of years and know the basics.
The program core dumps on the first packet of several pcap files I’ve tried. For example,
I tried bro on a pcap file used in a recent bro workshop tutorial called trace1.tcpdump, and I've
attached the first 20 packets (in test.tcpdump) just to be sure we're on the same page. If I run

bro -r test.tcpdump

I get a segmentation fault on the first packet. This is the output from gdb ......

test.tcpdump (1.54 KB)

2

I suspect this is due to an alignment issue with the connection compressor's
tricks with pointers, but I'll let Robin comment on that.

One immediate comment:

  bro -t -r test.tcpdump

-t takes an argument, so this is creating an execution trace file called
"-r" and then reading test.tcpdump as a Bro script, hence all of the
"unrecognized character" complaints.

    Vern

3

I suspect so too. Terry, can you try running with an additional
"use_connection_compressor=F" on the command line and see if that
avoids the crash?

Robin