Honeypots
Doubt regarding Honeywall Oct 03 2006 03:46PM
mng3@libero.it (mng3 libero it) (1 replies)
´ð¸´: Doubt regarding Honeywall Oct 03 2006 04:49PM
lobatt (lobatt sohu com)
Did you use a subnet address to specify your honeypots in honeywall?
If so, use the ip address of your honeypot instead when configuring the
honeywall.
Best regards!

lobatt

-----ÓʼþÔ­¼þ-----
·¢¼þÈË: listbounce (at) securityfocus (dot) com [email concealed] [mailto:listbounce (at) securityfocus (dot) com [email concealed]]
´ú±í mng3 (at) libero (dot) it [email concealed]
·¢ËÍʱ¼ä: 2006Äê10ÔÂ3ÈÕ 23:46
ÊÕ¼þÈË: honeypot honeypot
Ö÷Ìâ: Doubt regarding Honeywall

Hi all,
I'm configuring a little honeynet: the Honeywall and one honeypot running
WinXP Pro SP2.
I have deployed the honeynet in my LAN, so the honeypot is in the same
subnet of my production system.

My doubt is the following: the Walleye web interface, in the "Top 10
Honeypots" section show not only honeypot's IP address, but also IP address
of some production systems.

Moreover, when I examine the connection tracked by Honeywall, I see also
connections between system that are NOT the honeypot.

Is this behaviour normal?
The Honeywall are working fine?

thanks

------------------------------------------------------
Salva ora il tuo preventivo Direct Line e assicurati lo sconto extra 5+5%
sulla polizza auto entro il 31 Ottobre!
http://click.libero.it/directline4

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus