honeyd + snort

[James Chong <james_cwy () yahoo com>]

This question is related to both honeyd and snort in
some way.

Say, I am running snort, ACID, arpd, honeyd on a PC at
the IP address - 172.32.10.165 on the local network.
This PC will emulate 3 virtual honeypots using the
IPs:
172.32.10.170-172.32.10.172.

So, arpd will be monitoring these 3 addresses.

My question is: For snort, how do I configure the
snort.conf file at var HOME_NET ?

Do I use the IP of the PC running honeyd or use the
IPs running the emulated honeypot?

Please advise.
Thanks
James

__________________________________
Do you Yahoo!?
Yahoo! Search - Find what you’re looking for faster
http://search.yahoo.com