Honeypots mailing list archives
Re: question about honeyd 0.6a (linux)
From: Han Xu <xuhan () cc gatech edu>
Date: Tue, 23 Sep 2003 00:30:53 -0400 (EDT)
Thanks for your reply. Your questions made me learn something. anyway, my problem kept unresolved yet. Let me re-state it in clearer way: I ran arpd and honeyd 0.6a on a host, which has IP: 10.1.1.11 The arpd and honeyd simulates 10.1.1.20-10.1.1.200 (unused IPs on LAN): ------------------------- arpd 10.1.1.20-10.1.1.200 honeyd -p nmap.prints -x xprobe2.prints -a nmap.assoc \ -l /var/log/honeyd 10.1.1.20-10.1.1.200 ------------------------- Now, I tried to telnet 10.1.1.100 from this _same_ host: $>telnet 10.1.1.100 Trying 10.1.1.100... telnet: connect to address 100.1.1.100: No route to host and honeyd didn't log anything into /var/log/honeyd so, my question is: Is that possible to let honeyd accept such connection from the hosting machine ? (actually, I believe it succeeded once, but I can't repeat it, I don't know what happened.) btw, I am not sure if this list is THE list to ask such questions, if not, would you tell me what place to go ? thanks, Han On Sun, 21 Sep 2003, oudot wrote:
Han Xu a écrit: > Hi, > > I installed honeyd 0.6a on a Redhat Linux 7.1. Everything runs > well except one thing. > > I cannot let honeyd to capture the communications from the same host. > The detail is: > The host IP is 10.1.1.11, Honeyd simulates 10.1.1.1 - 10.1.1.255. Not exactly related to your problem but taken from the FAQ of honeyd (http://www.citi.umich.edu/u/provos/honeyd/faq.html) : Is it possible to run Honeyd on an exisiting IP address? Honeyd normally requires its own IP address space... > 10.1.1.100 is one of the virtual hosts that don't exist on the LAN. > When I ran "telnet 10.1.1.100" from another Linux on the same LAN, the > honeyd captured the request and logged it. But when I ran the > same thing from the local host (where the honeyd is running), I got "No > route" and honeyd seems do nothing with the packet. > > I noticed that, by default, arpd and honeyd ignore the src MAC address by > setting the filter to pcap. So I modified the source code to remove that > filter. Hmm, not a natural user :-) > Now the arpd shows it replies to "10.1.1.100", but nothing more. > Have you investigate ? I mean, what is the routing table and arp table of the honeyd host ? Have you specific firewall rules (i got strange problems with linux in the past on such a box) ? When you say that arpd replies, you mean that you saw the ARP answers worked properly ? Notice that you can also use arp to put a the MAC address in the cache without patching Arpd if you want a natural solution (put that in your rc filez for example), but if you need that for hundreds of host, that won't be funny... Have you tried to tcpdump the interface where honeyd listens (and the lo interface also..) to see where your packets go through ? > Any ideas ? Thanks in advance. I don't have so much ideas, just questions, but if it can help.. laurent oudot
Current thread:
- InfoSec Writers - requesting honeypot papers Von Spangler (Sep 21)
- question about honeyd 0.6a (linux) Han Xu (Sep 21)
- Re: question about honeyd 0.6a (linux) oudot (Sep 21)
- Re: question about honeyd 0.6a (linux) Han Xu (Sep 23)
- Re: question about honeyd 0.6a (linux) Christopher J Carella (Sep 23)
- Re: question about honeyd 0.6a (linux) oudot (Sep 21)
- question about honeyd 0.6a (linux) Han Xu (Sep 21)