[Bro-Dev] [JIRA] (BIT-1108) Add broctl option to set PF_RING cluster type
[ https://bro-tracker.atlassian.net/browse/BIT-1108?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Robin Sommer updated BIT-1108: -- Resolution: Merged (was: Fixed) Status: Closed (was: Merge Request) Add broctl option to set PF_RING cluster type - Key: BIT-1108 URL: https://bro-tracker.atlassian.net/browse/BIT-1108 Project: Bro Issue Tracker Issue Type: Problem Components: BroControl Reporter: Daniel Thayer Fix For: 2.3 Currently, when using PF_RING, broctl chooses the PF_RING cluster type by setting the environment variable PCAP_PF_RING_USE_CLUSTER_PER_FLOW. In order to use a different cluster type, we would need to set a different environment variable (the PF_RING-aware libpcap does not look at the actual value of the environment variable, just whether the variable is defined or not), but there is no option in broctl to do this. To address this issue, a new broctl option PFRINGClusterType can be added, then a user could change the value of this option to choose a different PF_RING cluster type (and the broctl pf_ring plugin would set the appropriate env. variable). The allowed values of this new broctl option would be: 2-tuple, 4-tuple, 5-tuple, tcp-5-tuple, round-robin, or 6-tuple (this one corresponds to the current cluster type used by broctl). By default, PFRINGClusterType would be set to 6-tuple. -- This message was sent by Atlassian JIRA (v6.2-OD-07-027#6211) ___ bro-dev mailing list bro-dev@bro.org http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
[Bro-Dev] [JIRA] (BIT-1111) will not start
Chas DiFatta created BIT-: - Summary: will not start Key: BIT- URL: https://bro-tracker.atlassian.net/browse/BIT- Project: Bro Issue Tracker Issue Type: Problem Components: Bro Affects Versions: 2.2 Environment: Mac OSX 10.9 Reporter: Chas DiFatta Priority: High there is a problem when starting as i get the following error internal error: can't load magic file default: no magic files loaded /opt/bro/share/broctl/scripts/run-bro: line 82: 1175 Abort trap: 6 (core dumped) nohup $mybro $@ have a new mac running 10.9. downloaded 2.2 for OSX, it installed fine. followed the recommended changes to the config files. ran the following command as root. sh-3.2# ./broctl Welcome to BroControl 1.2 Type help for help. [BroControl] install removing old policies in /opt/bro/spool/installed-scripts-do-not-touch/site ... done. removing old policies in /opt/bro/spool/installed-scripts-do-not-touch/auto ... done. creating policy directories ... done. installing site policies ... done. generating standalone-layout.bro ... done. generating local-networks.bro ... done. generating broctl-config.bro ... done. updating nodes ... done. [BroControl] start starting bro ... . bro terminated immediately after starting; check output with diag [BroControl] diag [bro] Bro 2.2 Darwin 13.0.0 No gdb installed. No reporter.log stderr.log internal error: can't load magic file default: no magic files loaded /opt/bro/share/broctl/scripts/run-bro: line 82: 1175 Abort trap: 6 (core dumped) nohup $mybro $@ stdout.log unlimited unlimited unlimited .cmdline -i eh0 -U .status -p broctl -p broctl-live -p standalone -p local -p bro local.bro broctl broctl/standalone broctl/auto .env_vars PATH=/opt/bro/bin:/opt/bro/share/broctl/scripts:/opt/local/bin:/opt/local/sbin:/opt/local/bin:/opt/local/sbin:/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin BROPATH=/opt/bro/spool/installed-scripts-do-not-touch/site::/opt/bro/spool/installed-scripts-do-not-touch/auto:/opt/bro/share/bro:/opt/bro/share/bro/policy:/opt/bro/share/bro/site CLUSTER_NODE= .status TERMINATED [internal_error] No prof.log No packet_filter.log No loaded_scripts.log -- This message was sent by Atlassian JIRA (v6.2-OD-07-027#6211) ___ bro-dev mailing list bro-dev@bro.org http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
