Unable send data on BEEP Channel after sending some frames and RST problems

Rajesh Madabhushi <[email protected]> Thu, 12 Sep 2002 09:56:23 +0530
Newsgroups gmane.network.beep.roadrunner.general
Message-ID <[email protected]>
Hi All,

Our product sends IDMEF(Alert/Heartbeat) messages to Intrusion Detection 
Manger (IDM) through IDXP. In order to test our software, I prepared small 
IDM by using Road Runner IDXP ,Road Runner BEEP and LibIDMEF of Silicon 
Defense to parse IDMEF messages. The Idea is, parses IDMEF messages 
received and sends back the replies(OK/Error message) once Session and 
Channels are established. Creating two channels one for 'Alert's and second 
for 'Heartbeats'
To achieve this, I modified my_consumer() function of 
'rridxp-0.2/tests/rridxp-server.c' to parses IDMEF messages received and 
replies TRUE/FALSE. Also changed in frame_available() of 'rridxp.c' to send 
back the replies.
Is it correct way to do this ?
It is working fine with single IDMEF message. But after sending replies to 
certain number of IDMEF Messages in loop, it stop sending any replies to 
IDMEF messages sent, even after successful parsing of the message. Using 
'rr_channel_send_message()' to send back replies.

The last two BEEP Frame received from IDM is:

RPY 39 129 . 4153 32
Content-Type: Text/xml
<ok />END
RPY 39 130 * 4185 7
ContentEND

After this no replies
Could any body tell me reason for this behavior? Am I doing any thing wrong ?
If anybody wants, I can send net.log' for BEEP traffic generated at IDM. 
Also the modified RR IDXP files.

I also receiving TCP RST from IDM, Reason for RST is Frame Syntax Error or 
Sequence number mismatch in the BEEP frames. But I am sending BEEP sequence 
numbers in correct order and BEEP Frame Payload contents in correct size. 
But not getting this type of error for 'Heartbeat' Keep Alive messages that 
sends periodically to IDM. The problem is with 'Alert' messages only 
sending every message in multiple BEEP Frames. However behavior is fine 
with sending of single messages instead in loop. Sorry for re-sending of 
old problem, same(RST problem) was reported earlier and also got reply from 
Jonas, but I couldn't make out from this, sending again to link with 
current problem.

Thank you,
Rajesh