I had no problems after the upgrade to High Sierra on my “production” box, and I had no troubles compiling Bro 2.5.1 on my laptop.
I did, however, get a two errors in the test suite. core.truncation ... failed % 'btest-diff output' failed unexpectedly (exit code 1) % cat .diag == File =============================== #separator \x09 #set_separator , #empty_field (empty) #unset_field - #path weird #open 2017-10-04-18-48-40 #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer #types time string addr port addr port string string bool string 1334160095.895421 - - - - - truncated_IP bro #close 2017-10-04-18-48-40 #separator \x09 #set_separator , #empty_field (empty) #unset_field - #path weird #open 2017-10-04-18-48-41 #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer #types time string addr port addr port string string bool string 1334156241.519125 - - - - - truncated_IP bro #close 2017-10-04-18-48-41 #separator \x09 #set_separator , #empty_field (empty) #unset_field - #path weird #open 2017-10-04-18-48-41 #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer #types time string addr port addr port string string bool string 1334094648.590126 - - - - - truncated_IP bro #close 2017-10-04-18-48-41 #separator \x09 #set_separator , #empty_field (empty) #unset_field - #path weird #open 2017-10-04-18-48-43 #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer #types time string addr port addr port string string bool string 1338328954.078361 - - - - - internally_truncated_header - F bro #close 2017-10-04-18-48-43 #separator \x09 #set_separator , #empty_field (empty) #unset_field - #path weird #open 2017-10-04-18-48-43 #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer #types time string addr port addr port string string bool string 1404148886.981015 - - - - - bad_IP_checksumbro 1404148887.011158 CHhAvVGS1DHFjwGM9 192.168.4.149 51293 72.21.91.29 443 bad_TCP_checksum - F bro #close 2017-10-04-18-48-43 == Diff =============================== --- /tmp/test-diff.62112.output.baseline.tmp 2017-10-04 18:48:43.000000000 +0000 +++ /tmp/test-diff.62112.output.tmp 2017-10-04 18:48:43.000000000 +0000 @@ -46,5 +46,6 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer #types time string addr port addr port string string bool string -0.000000 - - - - - truncated_link_header bro +XXXXXXXXXX.XXXXXX - - - - - bad_IP_checksumbro +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.4.149 51293 72.21.91.29 443 bad_TCP_checksum - F bro #close XXXX-XX-XX-XX-XX-XX ======================================= % cat .stderr 1404148887.011158 warning in /Users/slagell/Downloads/bro-2.5.1/scripts/base/misc/find-checksum-offloading.bro, line 54: Your trace file likely has invalid IP and TCP checksums, most likely from NIC checksum offloading. By default, packets with invalid checksums are discarded by Bro unless using the -C command-line option or toggling the 'ignore_checksums' variable. Alternatively, disable checksum offloading by the network adapter to ensure Bro analyzes the actual checksums that are transmitted. 1404148887.011158 warning in /Users/slagell/Downloads/bro-2.5.1/scripts/base/misc/find-filtered-trace.bro, line 48: The analyzed trace file was determined to contain only TCP control packets, which may indicate it's been pre-filtered. By default, Bro reports the missing segments for this type of trace, but the 'detect_filtered_trace' option may be toggled if that's not desired. istate.bro-ipv6-socket ... failed % 'btest-bg-wait 20' failed unexpectedly (exit code 1) % cat .stderr The following processes did not terminate: bro -b ../recv.bro bro -b ../send.bro ----------- <<< [72978] bro -b ../recv.bro received termination signal >>> <<< [72998] bro -b ../send.bro received termination signal >>> ------ Adam J. Slagell Director, Cybersecurity & Networking Division Chief Information Security Officer National Center for Supercomputing Applications University of Illinois at Urbana-Champaign www.slagell.info "Under the Illinois Freedom of Information Act (FOIA), any written communication to or from University employees regarding University business is a public record and may be subject to public disclosure." _______________________________________________ bro-dev mailing list [email protected] http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
