errors attempting to parse pcap file

[tbernhardson]

Downloaded IVRE last week, running latest zeek (v5.0.0) on Ubuntu 20.04.4 LTS (fully patched).
When attempting to load/parse a pcap file (captured with tcpdump -i eno2 -s 65535 -w filename) I am getting the following errors in ja3.zeek:

error in /usr/local/share/ivre/zeek/ivre/passiverecon/././ja3.zeek, line 141: empty constructor in untyped initialization (vector())
error in /usr/local/share/ivre/zeek/ivre/passiverecon/././ja3.zeek, line 152 and /opt/zeek/share/zeek/base/init-bare.zeek, line 90: type mismatch (PassiveRecon::ciphers_string and string_vec)
error in /usr/local/share/ivre/zeek/ivre/passiverecon/././ja3.zeek, line 152: argument type mismatch in function call (join_string_vec(PassiveRecon::ciphers_string, -))

any idea what I should be looking for to solve the issue?
eno2 is connected to a Cisco SPAN Port.

[p-l-]

Hi there,

Thanks for using IVRE, and thanks for this question. Short answer is: that's a bug in IVRE. Or, more precisely, IVRE does not (yet) support Zeek 5. I have opened an issue (#1395) to track it, and it should be fixed in #1396. Can you apply the patch from this PR and check whether it works for you?

All the best,

Pierre