Honeypots mailing list archives
Unwanted traffic in honeynet
From: "Martin Kristensen" <martink () student hin no>
Date: Tue, 19 Apr 2005 11:37:56 +0200
Hello everyone I thought the public_ip value set in the firewall scripts would stop traffic that wasn't ment for the honeynet. Our honeypots have public ip's like xxx.xx.124.14 and xxx.xx.124.15 with a broadcast adress of xxx.xx.125.255. The 124 and 125 net are the same so that the prefix would be xxx.xx.125/24 But we're getting unwanted traffic in our snort logs. Traffic that were ment for other computers on the same lan, like xxx.xx.124.89 Have we configured something wrong in the scripts? Anyone experienced the same? Regards Martin and Elena
Current thread:
- Unwanted traffic in honeynet Martin Kristensen (Apr 19)
- Re: Unwanted traffic in honeynet Diego Gonzalez Gomez (Apr 19)