Weird stuff in weird.log?

Zeek
1

Hi,
testing out bro and here is my next question to the bro-list.
I am seeing some weird stuff in weird.log(yeah! doh!).I am getting alot
of stuff like nappropriate_FIN, data_before_established,
possible_split_routing, active_connection_reuse etc.

Where can I control / diasable these weird-messages and control what
gets logged? I suspect that it is due to the fact that I am spanning
multiple VLANs that Bro sees, with traffic both before and after
loabalancers and NATs etc. so it kind-of sees the whole chain of packets
from outside the firewall, before / after loadbalancer behind firewall
and finally the traffic behind the loadbalancers/firewalls...would that
in some way explain the weird.log stuff shown here?

1366445558.221865 sMz3SRMvJ1f <UBFUCSATED-SRCIP> 57597
<UBFUCSATED-DSTIP> 30390 inappropriate_FIN - F bro
1366445558.778349 28ucePIK0f5 <UBFUCSATED-SRCIP> 389
<UBFUCSATED-DSTIP> 47584 data_before_established - F bro
1366445558.803882 C1cexKcJdhd <UBFUCSATED-SRCIP> 389
<UBFUCSATED-DSTIP> 34297 data_before_established - F bro
1366445558.823156 C1cexKcJdhd <UBFUCSATED-SRCIP> 389
<UBFUCSATED-DSTIP> 34297 inappropriate_FIN - F bro
1366445559.364974 C2jakgfKyh6 <UBFUCSATED-SRCIP> 389
<UBFUCSATED-DSTIP> 34300 data_before_established - F bro
1366445559.368926 M4MZKG1MEtk <UBFUCSATED-SRCIP> 41978
<UBFUCSATED-DSTIP> 5666 possible_split_routing - F bro
1366445559.368936 M4MZKG1MEtk <UBFUCSATED-SRCIP> 41978
<UBFUCSATED-DSTIP> 5666 data_before_established - F bro
1366445559.369958 II9kgjUU29i <UBFUCSATED-SRCIP> 33842
<UBFUCSATED-DSTIP> 5666 possible_split_routing - F bro
1366445559.370258 II9kgjUU29i <UBFUCSATED-SRCIP> 33842
<UBFUCSATED-DSTIP> 5666 data_before_established - F bro
1366445559.458949 C2jakgfKyh6 <UBFUCSATED-SRCIP> 389
<UBFUCSATED-DSTIP> 34300 inappropriate_FIN - F bro
1366445559.590081 xzP6usa0oXd <UBFUCSATED-SRCIP> 9997
<UBFUCSATED-DSTIP> 63028 inappropriate_FIN - F bro
1366445559.590095 5XYkXUNzYFd <UBFUCSATED-SRCIP> 9997
<UBFUCSATED-DSTIP> 47501 inappropriate_FIN - F bro
1366445559.775448 6wzuYevBpef <UBFUCSATED-SRCIP> 37270
<UBFUCSATED-DSTIP> 30310 possible_split_routing - F bro
1366445559.775824 6wzuYevBpef <UBFUCSATED-SRCIP> 37270
<UBFUCSATED-DSTIP> 30310 data_before_established - F bro
1366445559.779481 6wzuYevBpef <UBFUCSATED-SRCIP> 37270
<UBFUCSATED-DSTIP> 30310 inappropriate_FIN - F bro
1366445560.873320 NM2tVOQW5Nb <UBFUCSATED-SRCIP> 60618
<UBFUCSATED-DSTIP> 22 active_connection_reuse - F bro
1366445560.874857 P5qPMPaCUuf <UBFUCSATED-SRCIP> 60618
<UBFUCSATED-DSTIP> 22 possible_split_routing - F bro
1366445560.875449 P5qPMPaCUuf <UBFUCSATED-SRCIP> 60618
<UBFUCSATED-DSTIP> 22 inappropriate_FIN - F bro
1366445561.235377 n4cK9P7xS14 <UBFUCSATED-SRCIP> 47275
<UBFUCSATED-DSTIP> 30310 possible_split_routing - F bro
1366445561.235455 n4cK9P7xS14 <UBFUCSATED-SRCIP> 47275
<UBFUCSATED-DSTIP> 30310 data_before_established - F bro
1366445561.238828 n4cK9P7xS14 <UBFUCSATED-SRCIP> 47275
<UBFUCSATED-DSTIP> 30310 inappropriate_FIN - F bro
1366445562.716152 b7hwy5hPMx3 <UBFUCSATED-SRCIP> 34664
<UBFUCSATED-DSTIP> 30390 possible_split_routing - F bro
1366445562.716642 b7hwy5hPMx3 <UBFUCSATED-SRCIP> 34664
<UBFUCSATED-DSTIP> 30390 data_before_established - F bro
1366445562.720299 b7hwy5hPMx3 <UBFUCSATED-SRCIP> 34664
<UBFUCSATED-DSTIP> 30390 inappropriate_FIN - F bro
1366445563.029829 3JCdOtzkBL1 <UBFUCSATED-SRCIP> 1523
<UBFUCSATED-DSTIP> 35631 data_before_established - F bro
1366445563.030430 3JCdOtzkBL1 <UBFUCSATED-SRCIP> 1523
<UBFUCSATED-DSTIP> 35631 active_connection_reuse - F bro
1366445563.039064 PuQti8prAgc <UBFUCSATED-SRCIP> 35631
<UBFUCSATED-DSTIP> 1523 data_after_reset - F bro
1366445563.244717 yUB4KmfF8hi <UBFUCSATED-SRCIP> 57618
<UBFUCSATED-DSTIP> 30390 possible_split_routing - F bro
1366445563.245336 yUB4KmfF8hi <UBFUCSATED-SRCIP> 57618
<UBFUCSATED-DSTIP> 30390 data_before_established - F bro
1366445563.250505 yUB4KmfF8hi <UBFUCSATED-SRCIP> 57618
<UBFUCSATED-DSTIP> 30390 inappropriate_FIN - F bro
1366445563.698203 UupX3wx5GT9 <UBFUCSATED-SRCIP> 52198
<UBFUCSATED-DSTIP> 22 active_connection_reuse - F bro
1366445564.737450 AnRairldCP3 <UBFUCSATED-SRCIP> 37289
<UBFUCSATED-DSTIP> 30310 possible_split_routing - F bro
1366445564.737835 AnRairldCP3 <UBFUCSATED-SRCIP> 37289
<UBFUCSATED-DSTIP> 30310 data_before_established - F bro
1366445564.742235 AnRairldCP3 <UBFUCSATED-SRCIP> 37289
<UBFUCSATED-DSTIP> 30310 inappropriate_FIN - F bro
1366445565.118886 ITn36vbahlj <UBFUCSATED-SRCIP> 52576
<UBFUCSATED-DSTIP> 5666 possible_split_routing - F bro
1366445565.119184 ITn36vbahlj <UBFUCSATED-SRCIP> 52576
<UBFUCSATED-DSTIP> 5666 data_before_established - F bro
1366445565.148984 shxX8UNt1a3 <UBFUCSATED-SRCIP> 59902
<UBFUCSATED-DSTIP> 5666 possible_split_routing - F bro
1366445565.149235 shxX8UNt1a3 <UBFUCSATED-SRCIP> 59902
<UBFUCSATED-DSTIP> 5666 data_before_established - F bro
1366445565.885159 Dj3WAdR8v5b <UBFUCSATED-SRCIP> 60728
<UBFUCSATED-DSTIP> 22 active_connection_reuse - F bro
1366445565.885595 rDy60hYCOdg <UBFUCSATED-SRCIP> 60728
<UBFUCSATED-DSTIP> 22 possible_split_routing - F bro
1366445565.886074 rDy60hYCOdg <UBFUCSATED-SRCIP> 60728
<UBFUCSATED-DSTIP> 22 inappropriate_FIN - F bro
1366445566.158385 5B8TeJKxXi3 <UBFUCSATED-SRCIP> 47294
<UBFUCSATED-DSTIP> 30310 possible_split_routing - F bro
1366445566.158716 5B8TeJKxXi3 <UBFUCSATED-SRCIP> 47294
<UBFUCSATED-DSTIP> 30310 data_before_established - F bro
1366445566.162550 5B8TeJKxXi3 <UBFUCSATED-SRCIP> 47294
<UBFUCSATED-DSTIP> 30310 inappropriate_FIN - F bro
1366445567.751813 vC30wQV7K7j <UBFUCSATED-SRCIP> 34685
<UBFUCSATED-DSTIP> 30390 possible_split_routing - F bro
1366445567.752999 vC30wQV7K7j <UBFUCSATED-SRCIP> 34685
<UBFUCSATED-DSTIP> 30390 data_before_established - F bro
1366445567.757998 vC30wQV7K7j <UBFUCSATED-SRCIP> 34685
<UBFUCSATED-DSTIP> 30390 inappropriate_FIN - F bro
1366445568.176397 RYxS3He4jqa <UBFUCSATED-SRCIP> 57637
<UBFUCSATED-DSTIP> 30390 possible_split_routing - F bro
1366445568.176683 RYxS3He4jqa <UBFUCSATED-SRCIP> 57637
<UBFUCSATED-DSTIP> 30390 data_before_established - F bro
1366445568.180986 RYxS3He4jqa <UBFUCSATED-SRCIP> 57637
<UBFUCSATED-DSTIP> 30390 inappropriate_FIN - F bro
1366445568.779173 xatDJTfRKT5 <UBFUCSATED-SRCIP> 9997
<UBFUCSATED-DSTIP> 32941 inappropriate_FIN - F bro
1366445568.779185 iShp45vkZB5 <UBFUCSATED-SRCIP> 9997
<UBFUCSATED-DSTIP> 47413 inappropriate_FIN - F bro
1366445569.125537 Ibw0hED2Fob <UBFUCSATED-SRCIP> 36384
<UBFUCSATED-DSTIP> 9997 possible_split_routing - F bro
1366445569.125548 uUEy466ylTf <UBFUCSATED-SRCIP> 47952
<UBFUCSATED-DSTIP> 9997 possible_split_routing - F bro
1366445569.692394 eXp0EbWU2Ka <UBFUCSATED-SRCIP> 63605
<UBFUCSATED-DSTIP> 9997 possible_split_routing - F bro
1366445569.692469 c12zuBPumRj <UBFUCSATED-SRCIP> 14686
<UBFUCSATED-DSTIP> 9997 possible_split_routing - F bro
1366445569.763472 sA21Rb4LVz5 <UBFUCSATED-SRCIP> 37310
<UBFUCSATED-DSTIP> 30310 possible_split_routing - F bro
1366445569.764000 sA21Rb4LVz5 <UBFUCSATED-SRCIP> 37310
<UBFUCSATED-DSTIP> 30310 data_before_established - F bro
1366445569.767989 sA21Rb4LVz5 <UBFUCSATED-SRCIP> 37310
<UBFUCSATED-DSTIP> 30310 inappropriate_FIN - F bro
1366445570.908940 GD1tiVPOnRf <UBFUCSATED-SRCIP> 60836
<UBFUCSATED-DSTIP> 22 active_connection_reuse - F bro
1366445570.909404 kveiMvxFbZ2 <UBFUCSATED-SRCIP> 60836
<UBFUCSATED-DSTIP> 22 possible_split_routing - F bro
1366445570.909679 kveiMvxFbZ2 <UBFUCSATED-SRCIP> 60836
<UBFUCSATED-DSTIP> 22 inappropriate_FIN - F bro
1366445571.216116 GmMDwe1BuF2 <UBFUCSATED-SRCIP> 47317
<UBFUCSATED-DSTIP> 30310 possible_split_routing - F bro
1366445571.216465 GmMDwe1BuF2 <UBFUCSATED-SRCIP> 47317
<UBFUCSATED-DSTIP> 30310 data_before_established - F bro
1366445571.220271 GmMDwe1BuF2 <UBFUCSATED-SRCIP> 47317
<UBFUCSATED-DSTIP> 30310 inappropriate_FIN - F bro
1366445572.701760 3nU4LDW2lm3 <UBFUCSATED-SRCIP> 34704
<UBFUCSATED-DSTIP> 30390 possible_split_routing - F bro
1366445572.702540 3nU4LDW2lm3 <UBFUCSATED-SRCIP> 34704
<UBFUCSATED-DSTIP> 30390 data_before_established - F bro
1366445572.710165 3nU4LDW2lm3 <UBFUCSATED-SRCIP> 34704
<UBFUCSATED-DSTIP> 30390 inappropriate_FIN - F bro
1366445573.232767 BjdVV5GUd2b <UBFUCSATED-SRCIP> 57660
<UBFUCSATED-DSTIP> 30390 possible_split_routing - F bro
1366445573.233064 BjdVV5GUd2b <UBFUCSATED-SRCIP> 57660
<UBFUCSATED-DSTIP> 30390 data_before_established - F bro
1366445573.237140 BjdVV5GUd2b <UBFUCSATED-SRCIP> 57660
<UBFUCSATED-DSTIP> 30390 inappropriate_FIN - F bro
1366445574.510449 r1qXhtWW1bj <UBFUCSATED-SRCIP> 9997
<UBFUCSATED-DSTIP> 44302 inappropriate_FIN - F bro
1366445574.510660 tObvNwyOY2g <UBFUCSATED-SRCIP> 9997
<UBFUCSATED-DSTIP> 35674 inappropriate_FIN - F bro
1366445574.730389 TcPdkyidOv2 <UBFUCSATED-SRCIP> 37329
<UBFUCSATED-DSTIP> 30310 possible_split_routing - F bro
1366445574.730846 TcPdkyidOv2 <UBFUCSATED-SRCIP> 37329
<UBFUCSATED-DSTIP> 30310 data_before_established - F bro
1366445574.735051 TcPdkyidOv2 <UBFUCSATED-SRCIP> 37329
<UBFUCSATED-DSTIP> 30310 inappropriate_FIN - F bro
1366445575.913782 yDxehi4Al72 <UBFUCSATED-SRCIP> 60946
<UBFUCSATED-DSTIP> 22 active_connection_reuse - F bro
1366445577.063401 otQNSnT4EN6 <UBFUCSATED-SRCIP> 5666
<UBFUCSATED-DSTIP> 51277 active_connection_reuse - F bro
1366445577.063728 UWRLM9DTaji <UBFUCSATED-SRCIP> 51277
<UBFUCSATED-DSTIP> 5666 data_before_established - F bro
1366445577.743207 Mwz8weyGyR3 <UBFUCSATED-SRCIP> 34725
<UBFUCSATED-DSTIP> 30390 possible_split_routing - F bro
1366445577.743652 Mwz8weyGyR3 <UBFUCSATED-SRCIP> 34725
<UBFUCSATED-DSTIP> 30390 data_before_established - F bro
1366445577.747345 Mwz8weyGyR3 <UBFUCSATED-SRCIP> 34725
<UBFUCSATED-DSTIP> 30390 inappropriate_FIN - F bro
1366445578.059666 iswlXZ1p4Ub <UBFUCSATED-SRCIP> 9997
<UBFUCSATED-DSTIP> 40619 inappropriate_FIN - F bro
1366445578.059827 E20A0zNnKr1 <UBFUCSATED-SRCIP> 9997
<UBFUCSATED-DSTIP> 44455 inappropriate_FIN - F bro
1366445578.183760 5Y37osqnKkf <UBFUCSATED-SRCIP> 57679
<UBFUCSATED-DSTIP> 30390 possible_split_routing - F bro
1366445578.184349 5Y37osqnKkf <UBFUCSATED-SRCIP> 57679
<UBFUCSATED-DSTIP> 30390 data_before_established - F bro
1366445578.187890 5Y37osqnKkf <UBFUCSATED-SRCIP> 57679
<UBFUCSATED-DSTIP> 30390 inappropriate_FIN - F bro
1366445578.204042 NC98VDwhyic <UBFUCSATED-SRCIP> 60005
<UBFUCSATED-DSTIP> 5666 possible_split_routing - F bro
1366445578.204270 NC98VDwhyic <UBFUCSATED-SRCIP> 60005
<UBFUCSATED-DSTIP> 5666 data_before_established - F bro
1366445578.244628 jj6AoPGcuda <UBFUCSATED-SRCIP> 1522
<UBFUCSATED-DSTIP> 28963 data_before_established - F bro
1366445578.244639 jj6AoPGcuda <UBFUCSATED-SRCIP> 1522
<UBFUCSATED-DSTIP> 28963 inappropriate_FIN - F bro
1366445578.706908 A1Zs7s7nXwk <UBFUCSATED-SRCIP> 52529
<UBFUCSATED-DSTIP> 22 active_connection_reuse - F bro
1366445579.765173 o2wIRfp99bf <UBFUCSATED-SRCIP> 37350
<UBFUCSATED-DSTIP> 30310 possible_split_routing - F bro
1366445579.765499 o2wIRfp99bf <UBFUCSATED-SRCIP> 37350
<UBFUCSATED-DSTIP> 30310 data_before_established - F bro
1366445579.770880 o2wIRfp99bf <UBFUCSATED-SRCIP> 37350
<UBFUCSATED-DSTIP> 30310 inappropriate_FIN - F bro
1366445580.926279 kbXAp4Y6A02 <UBFUCSATED-SRCIP> 32821
<UBFUCSATED-DSTIP> 22 active_connection_reuse - F bro
1366445580.926714 PisVwAmRZme <UBFUCSATED-SRCIP> 32821
<UBFUCSATED-DSTIP> 22 possible_split_routing - F bro
1366445580.926772 PisVwAmRZme <UBFUCSATED-SRCIP> 32821
<UBFUCSATED-DSTIP> 22 inappropriate_FIN - F bro
1366445581.207573 LiB2ITRfHhd <UBFUCSATED-SRCIP> 47357
<UBFUCSATED-DSTIP> 30310 possible_split_routing - F bro
1366445581.207883 LiB2ITRfHhd <UBFUCSATED-SRCIP> 47357
<UBFUCSATED-DSTIP> 30310 data_before_established - F bro
1366445581.214265 LiB2ITRfHhd <UBFUCSATED-SRCIP> 47357
<UBFUCSATED-DSTIP> 30310 inappropriate_FIN - F bro
1366445582.778903 L3DPgYmunWg <UBFUCSATED-SRCIP> 34746
<UBFUCSATED-DSTIP> 30390 possible_split_routing - F bro
1366445582.779365 L3DPgYmunWg <UBFUCSATED-SRCIP> 34746
<UBFUCSATED-DSTIP> 30390 data_before_established - F bro
1366445582.783030 L3DPgYmunWg <UBFUCSATED-SRCIP> 34746
<UBFUCSATED-DSTIP> 30390 inappropriate_FIN - F bro
1366445583.224117 Kj2jZLpcHQ8 <UBFUCSATED-SRCIP> 57700
<UBFUCSATED-DSTIP> 30390 possible_split_routing - F bro
1366445583.224643 Kj2jZLpcHQ8 <UBFUCSATED-SRCIP> 57700
<UBFUCSATED-DSTIP> 30390 data_before_established - F bro
1366445583.227992 Kj2jZLpcHQ8 <UBFUCSATED-SRCIP> 57700
<UBFUCSATED-DSTIP> 30390 inappropriate_FIN - F bro
1366445583.243559 e7hVXNWAcXd <UBFUCSATED-SRCIP> 5666
<UBFUCSATED-DSTIP> 59937 data_before_established - F bro
1366445583.243600 e7hVXNWAcXd <UBFUCSATED-SRCIP> 5666
<UBFUCSATED-DSTIP> 59937 active_connection_reuse - F bro
1366445583.243729 IQ7JRPICo5h <UBFUCSATED-SRCIP> 59937
<UBFUCSATED-DSTIP> 5666 possible_split_routing - F bro
1366445583.243797 IQ7JRPICo5h <UBFUCSATED-SRCIP> 59937
<UBFUCSATED-DSTIP> 5666 data_before_established - F bro
1366445583.701833 bCOWiFYHCD <UBFUCSATED-SRCIP> 52635
<UBFUCSATED-DSTIP> 22 active_connection_reuse - F bro
1366445584.687427 JGJvoLHFEB7 <UBFUCSATED-SRCIP> 37373
<UBFUCSATED-DSTIP> 30310 possible_split_routing - F bro
1366445584.687809 JGJvoLHFEB7 <UBFUCSATED-SRCIP> 37373
<UBFUCSATED-DSTIP> 30310 data_before_established - F bro
1366445584.691962 JGJvoLHFEB7 <UBFUCSATED-SRCIP> 37373
<UBFUCSATED-DSTIP> 30310 inappropriate_FIN - F bro
1366445586.153302 3Ob4kGkMRh1 <UBFUCSATED-SRCIP> 47376
<UBFUCSATED-DSTIP> 30310 possible_split_routing - F bro
1366445586.153590 3Ob4kGkMRh1 <UBFUCSATED-SRCIP> 47376
<UBFUCSATED-DSTIP> 30310 data_before_established - F bro
1366445586.157429 3Ob4kGkMRh1 <UBFUCSATED-SRCIP> 47376
<UBFUCSATED-DSTIP> 30310 inappropriate_FIN - F bro
1366445587.725699 tc0YRXXhLte <UBFUCSATED-SRCIP> 34771
<UBFUCSATED-DSTIP> 30390 possible_split_routing - F bro
1366445587.726034 tc0YRXXhLte <UBFUCSATED-SRCIP> 34771
<UBFUCSATED-DSTIP> 30390 data_before_established - F bro
1366445587.731125 tc0YRXXhLte <UBFUCSATED-SRCIP> 34771
<UBFUCSATED-DSTIP> 30390 inappropriate_FIN - F bro
1366445588.637477 Q02XJs56kOh <UBFUCSATED-SRCIP> 53571
<UBFUCSATED-DSTIP> 22 active_connection_reuse - F bro
1366445588.638637 6ZMW9bImJPk <UBFUCSATED-SRCIP> 53571
<UBFUCSATED-DSTIP> 22 possible_split_routing - F bro
1366445588.638854 6ZMW9bImJPk <UBFUCSATED-SRCIP> 53571
<UBFUCSATED-DSTIP> 22 inappropriate_FIN - F bro
1366445588.739231 0TqgtuL9f09 <UBFUCSATED-SRCIP> 52745
<UBFUCSATED-DSTIP> 22 active_connection_reuse - F bro
1366445589.240728 eGBBdQdpsa4 <UBFUCSATED-SRCIP> 51904
<UBFUCSATED-DSTIP> 9997 possible_split_routing - F bro
1366445589.241435 GuQiSBjJV81 <UBFUCSATED-SRCIP> 52907
<UBFUCSATED-DSTIP> 9997 possible_split_routing - F bro
1366445589.620204 OQ9yx4BafSe <UBFUCSATED-SRCIP> 9997
<UBFUCSATED-DSTIP> 63043 inappropriate_FIN - F bro
1366445589.620212 mJB9omzWSJ4 <UBFUCSATED-SRCIP> 9997
<UBFUCSATED-DSTIP> 47518 inappropriate_FIN - F bro
1366445589.669002 yP5EYio24W <UBFUCSATED-SRCIP> 9997
<UBFUCSATED-DSTIP> 41757 inappropriate_FIN - F bro
1366445589.669023 W7CKWaOEVy9 <UBFUCSATED-SRCIP> 9997
<UBFUCSATED-DSTIP> 33300 inappropriate_FIN - F bro
1366445589.746727 CrufwTKL6Ge <UBFUCSATED-SRCIP> 37396
<UBFUCSATED-DSTIP> 30310 possible_split_routing - F bro
1366445589.747158 CrufwTKL6Ge <UBFUCSATED-SRCIP> 37396
<UBFUCSATED-DSTIP> 30310 data_before_established - F bro
1366445589.750101 CrufwTKL6Ge <UBFUCSATED-SRCIP> 37396
<UBFUCSATED-DSTIP> 30310 inappropriate_FIN - F bro
1366445590.927663 DsNA8pbfsBc <UBFUCSATED-SRCIP> 33044
<UBFUCSATED-DSTIP> 22 active_connection_reuse - F bro
1366445590.929037 zhl0AijYsK <UBFUCSATED-SRCIP> 33044
<UBFUCSATED-DSTIP> 22 possible_split_routing - F bro
1366445590.929271 zhl0AijYsK <UBFUCSATED-SRCIP> 33044
<UBFUCSATED-DSTIP> 22 inappropriate_FIN - F bro
1366445591.201280 1eOWlJTZgA4 <UBFUCSATED-SRCIP> 47397
<UBFUCSATED-DSTIP> 30310 possible_split_routing - F bro
1366445591.201483 1eOWlJTZgA4 <UBFUCSATED-SRCIP> 47397
<UBFUCSATED-DSTIP> 30310 data_before_established - F bro
1366445591.205162 1eOWlJTZgA4 <UBFUCSATED-SRCIP> 47397
<UBFUCSATED-DSTIP> 30310 inappropriate_FIN - F bro
1366445592.084380 HzDFhdIAHGk <UBFUCSATED-SRCIP> 40657
<UBFUCSATED-DSTIP> 5666 possible_split_routing - F bro
1366445592.084641 HzDFhdIAHGk <UBFUCSATED-SRCIP> 40657
<UBFUCSATED-DSTIP> 5666 data_before_established - F bro
1366445592.131622 xOlqn2UHYBh <UBFUCSATED-SRCIP> 36773
<UBFUCSATED-DSTIP> 5666 possible_split_routing - F bro
1366445592.131814 xOlqn2UHYBh <UBFUCSATED-SRCIP> 36773
<UBFUCSATED-DSTIP> 5666 data_before_established - F bro
1366445592.132775 9RwZo1ZqMu7 <UBFUCSATED-SRCIP> 36776
<UBFUCSATED-DSTIP> 5666 possible_split_routing - F bro
1366445592.133552 9RwZo1ZqMu7 <UBFUCSATED-SRCIP> 36776
<UBFUCSATED-DSTIP> 5666 data_before_established - F bro
1366445592.134698 t5FrtDo8b99 <UBFUCSATED-SRCIP> 36777
<UBFUCSATED-DSTIP> 5666 possible_split_routing - F bro
1366445592.135041 t5FrtDo8b99 <UBFUCSATED-SRCIP> 36777
<UBFUCSATED-DSTIP> 5666 data_before_established - F bro
1366445592.165969 5ZAeOoyBTw4 <UBFUCSATED-SRCIP> 5666
<UBFUCSATED-DSTIP> 40250 active_connection_reuse - F bro
1366445592.166997 nwlzihurpM <UBFUCSATED-SRCIP> 40250
<UBFUCSATED-DSTIP> 5666 data_before_established - F bro
1366445592.769294 HtIFXqFKxc9 <UBFUCSATED-SRCIP> 34790
<UBFUCSATED-DSTIP> 30390 possible_split_routing - F bro
1366445592.769819 HtIFXqFKxc9 <UBFUCSATED-SRCIP> 34790
<UBFUCSATED-DSTIP> 30390 data_before_established - F bro
1366445592.773547 HtIFXqFKxc9 <UBFUCSATED-SRCIP> 34790
<UBFUCSATED-DSTIP> 30390 inappropriate_FIN - F bro
1366445593.220485 LCp8FbOMFyh <UBFUCSATED-SRCIP> 57740
<UBFUCSATED-DSTIP> 30390 possible_split_routing - F bro
1366445593.220765 LCp8FbOMFyh <UBFUCSATED-SRCIP> 57740
<UBFUCSATED-DSTIP> 30390 data_before_established - F bro
1366445593.224419 LCp8FbOMFyh <UBFUCSATED-SRCIP> 57740
<UBFUCSATED-DSTIP> 30390 inappropriate_FIN - F bro
1366445594.687187 CuOQQ7zeFv9 <UBFUCSATED-SRCIP> 37415
<UBFUCSATED-DSTIP> 30310 possible_split_routing - F bro
1366445594.687523 CuOQQ7zeFv9 <UBFUCSATED-SRCIP> 37415
<UBFUCSATED-DSTIP> 30310 data_before_established - F bro
1366445594.691361 CuOQQ7zeFv9 <UBFUCSATED-SRCIP> 37415
<UBFUCSATED-DSTIP> 30310 inappropriate_FIN - F bro
1366445596.150750 SBPXzXc2Ld4 <UBFUCSATED-SRCIP> 47416
<UBFUCSATED-DSTIP> 30310 possible_split_routing - F bro
1366445596.151009 SBPXzXc2Ld4 <UBFUCSATED-SRCIP> 47416
<UBFUCSATED-DSTIP> 30310 data_before_established - F bro
1366445596.154921 SBPXzXc2Ld4 <UBFUCSATED-SRCIP> 47416
<UBFUCSATED-DSTIP> 30310 inappropriate_FIN - F bro
1366445597.184565 qEiR2l1TFRk <UBFUCSATED-SRCIP> 56920
<UBFUCSATED-DSTIP> 389 possible_split_routing - F bro
1366445597.184651 qEiR2l1TFRk <UBFUCSATED-SRCIP> 56920
<UBFUCSATED-DSTIP> 389 data_before_established - F bro
1366445597.710011 SOoWl6RKWKh <UBFUCSATED-SRCIP> 34811
<UBFUCSATED-DSTIP> 30390 possible_split_routing - F bro
1366445597.710502 SOoWl6RKWKh <UBFUCSATED-SRCIP> 34811
<UBFUCSATED-DSTIP> 30390 data_before_established - F bro
1366445597.714152 SOoWl6RKWKh <UBFUCSATED-SRCIP> 34811
<UBFUCSATED-DSTIP> 30390 inappropriate_FIN - F bro
1366445598.056099 uggbZJSe6Y <UBFUCSATED-SRCIP> 38292
<UBFUCSATED-DSTIP> 22 active_connection_reuse - F bro
1366445598.166435 8sGmATv0hQe <UBFUCSATED-SRCIP> 57759
<UBFUCSATED-DSTIP> 30390 possible_split_routing - F bro
1366445598.166768 8sGmATv0hQe <UBFUCSATED-SRCIP> 57759
<UBFUCSATED-DSTIP> 30390 data_before_established - F bro
1366445598.171075 8sGmATv0hQe <UBFUCSATED-SRCIP> 57759
<UBFUCSATED-DSTIP> 30390 inappropriate_FIN - F bro
1366445598.314109 Dagu32rJNve <UBFUCSATED-SRCIP> 42335
<UBFUCSATED-DSTIP> 30090 possible_split_routing - F bro
1366445598.314407 Dagu32rJNve <UBFUCSATED-SRCIP> 42335
<UBFUCSATED-DSTIP> 30090 data_before_established - F bro
1366445598.317858 pUHgaskr6q4 <UBFUCSATED-SRCIP> 43443
<UBFUCSATED-DSTIP> 5666 possible_split_routing - F bro
1366445598.318003 pUHgaskr6q4 <UBFUCSATED-SRCIP> 43443
<UBFUCSATED-DSTIP> 5666 data_before_established - F bro
1366445598.337726 h9SmXzOmYj9 <UBFUCSATED-SRCIP> 34044
<UBFUCSATED-DSTIP> 5666 possible_split_routing - F bro
1366445598.337961 h9SmXzOmYj9 <UBFUCSATED-SRCIP> 34044
<UBFUCSATED-DSTIP> 5666 data_before_established - F bro
1366445598.342370 ze6jFUsuRrd <UBFUCSATED-SRCIP> 42337
<UBFUCSATED-DSTIP> 30090 possible_split_routing - F bro
1366445598.348767 ze6jFUsuRrd <UBFUCSATED-SRCIP> 42337
<UBFUCSATED-DSTIP> 30090 data_before_established - F bro
1366445598.420624 lW5R8mIZ1Rl <UBFUCSATED-SRCIP> 5666
<UBFUCSATED-DSTIP> 51409 active_connection_reuse - F bro
1366445598.420785 tbjrXcZo2F8 <UBFUCSATED-SRCIP> 51409
<UBFUCSATED-DSTIP> 5666 data_before_established - F bro
1366445598.833697 FbWPTvKfWE7 <UBFUCSATED-SRCIP> 9997
<UBFUCSATED-DSTIP> 47414 inappropriate_FIN - F bro
1366445598.833866 mPmGNK0x3Y7 <UBFUCSATED-SRCIP> 9997
<UBFUCSATED-DSTIP> 32944 inappropriate_FIN - F bro
1366445599.718553 qOMrTniwJO8 <UBFUCSATED-SRCIP> 37436
<UBFUCSATED-DSTIP> 30310 possible_split_routing - F bro
1366445599.718580 qOMrTniwJO8 <UBFUCSATED-SRCIP> 37436
<UBFUCSATED-DSTIP> 30310 data_before_established - F bro
1366445599.721075 qOMrTniwJO8 <UBFUCSATED-SRCIP> 37436
<UBFUCSATED-DSTIP> 30310 inappropriate_FIN - F bro
1366445601.197471 A6hBUcHyYn <UBFUCSATED-SRCIP> 47438
<UBFUCSATED-DSTIP> 30310 possible_split_routing - F bro
1366445601.197857 A6hBUcHyYn <UBFUCSATED-SRCIP> 47438
<UBFUCSATED-DSTIP> 30310 data_before_established - F bro
1366445601.201627 A6hBUcHyYn <UBFUCSATED-SRCIP> 47438
<UBFUCSATED-DSTIP> 30310 inappropriate_FIN - F bro
1366445602.737133 fMC2czM4ad5 <UBFUCSATED-SRCIP> 34830
<UBFUCSATED-DSTIP> 30390 possible_split_routing - F bro
1366445602.737195 fMC2czM4ad5 <UBFUCSATED-SRCIP> 34830
<UBFUCSATED-DSTIP> 30390 data_before_established - F bro
1366445602.739803 fMC2czM4ad5 <UBFUCSATED-SRCIP> 34830
<UBFUCSATED-DSTIP> 30390 inappropriate_FIN - F bro
1366445603.217926 5KQYxY7FEjd <UBFUCSATED-SRCIP> 57781
<UBFUCSATED-DSTIP> 30390 possible_split_routing - F bro
1366445603.218318 5KQYxY7FEjd <UBFUCSATED-SRCIP> 57781
<UBFUCSATED-DSTIP> 30390 data_before_established - F bro
1366445603.222483 5KQYxY7FEjd <UBFUCSATED-SRCIP> 57781
<UBFUCSATED-DSTIP> 30390 inappropriate_FIN - F bro
1366445604.158883 ND8g7Onxkol <UBFUCSATED-SRCIP> 9997
<UBFUCSATED-DSTIP> 35676 data_before_established - F bro
1366445604.598523 5BsmxtcRqUg <UBFUCSATED-SRCIP> 9997
<UBFUCSATED-DSTIP> 44304 inappropriate_FIN - F bro
1366445604.769609 mkfqXaTHoYd <UBFUCSATED-SRCIP> 37455
<UBFUCSATED-DSTIP> 30310 possible_split_routing - F bro
1366445604.769945 mkfqXaTHoYd <UBFUCSATED-SRCIP> 37455
<UBFUCSATED-DSTIP> 30310 data_before_established - F bro
1366445604.773733 mkfqXaTHoYd <UBFUCSATED-SRCIP> 37455
<UBFUCSATED-DSTIP> 30310 inappropriate_FIN - F bro
1366445606.233186 2YpIesZO8S8 <UBFUCSATED-SRCIP> 47457
<UBFUCSATED-DSTIP> 30310 possible_split_routing - F bro
1366445606.233483 2YpIesZO8S8 <UBFUCSATED-SRCIP> 47457
<UBFUCSATED-DSTIP> 30310 data_before_established - F bro
1366445606.237583 2YpIesZO8S8 <UBFUCSATED-SRCIP> 47457
<UBFUCSATED-DSTIP> 30310 inappropriate_FIN - F bro
1366445607.696371 pEFuDb9cZb8 <UBFUCSATED-SRCIP> 34851
<UBFUCSATED-DSTIP> 30390 possible_split_routing - F bro
1366445607.696856 pEFuDb9cZb8 <UBFUCSATED-SRCIP> 34851
<UBFUCSATED-DSTIP> 30390 data_before_established - F bro
1366445607.700532 pEFuDb9cZb8 <UBFUCSATED-SRCIP> 34851
<UBFUCSATED-DSTIP> 30390 inappropriate_FIN - F bro
1366445608.078190 VrW91Y7Afml <UBFUCSATED-SRCIP> 9997
<UBFUCSATED-DSTIP> 40622 inappropriate_FIN - F bro
1366445608.078379 T3BCgECYnt8 <UBFUCSATED-SRCIP> 9997
<UBFUCSATED-DSTIP> 44458 inappropriate_FIN - F bro
1366445608.161685 djiIIUpoL2 <UBFUCSATED-SRCIP> 57800
<UBFUCSATED-DSTIP> 30390 possible_split_routing - F bro
1366445608.162008 djiIIUpoL2 <UBFUCSATED-SRCIP> 57800
<UBFUCSATED-DSTIP> 30390 data_before_established - F bro

2

I suspect that it is due to the fact that I am spanning
multiple VLANs that Bro sees, with traffic both before and after
loabalancers and NATs etc. so it kind-of sees the whole chain of packets
from outside the firewall, before / after loadbalancer behind firewall
and finally the traffic behind the loadbalancers/firewalls...would that
in some way explain the weird.log stuff shown here?

That for sure would explain these sorts of "weird" messages, since they
all relate to Bro reporting that it's not seeing a single consistent
picture of (bidirectional) network flows.

    Vern

3

I am experiencing the same problem in the weired.log here as using one interface defined for the WAN and one for the LAN traffic (between there is a firewall and a loadbalancer with ssl-offload).
I am using the following node configuration:

[manager]
type=manager
host=10.XX.XX.11
[proxy-1]
type=proxy
host=10.XX.XX.11
[worker-1] --> WAN Connection
type=worker
host=10.XX.XX.11
interface=p6p1
lb_method=pf_ring
lb_procs=8
[worker-2] --> LAN Connection
type=worker
host=10.XX.XX.11
interface=p6p2
lb_method=pf_ring
lb_procs=8
[worker-3] --> dedicated line between two DCs
type=worker
host=10.XX.XX.11
interface=bond0
...

Question: What I meaningfully should do to get rid of this:
--> Running one bro cluster/instance for each interface?
--> Or is there are way to do it by an other configuration change?

Peter

4

Peter,
I was about to ask the list if splitting up interfaces / VLANs / snooping-points in different workers would fix it, but it seems you have done that and are still seeing the same weirdness.

May I ask what was your reason for having 3 workers and a proxy? I am still new to how to design and setup Bro with all the features it has…

Best regards,

Kim Halavakoski

Sent from my mobile device, excuse my clawfingerness!

Mobile N#: +358 [0] 40 702 7844
PGP S#: 0BFA A910 9AA7 94A5 A323 53F5 4151 4CE4 33BE 35FA
http://www.blackcatsec.net