Back to list
Re: Doubt regarding Honeywall
Oct 03 2006 05:03PM
Earl (esammons hush com)
-----BEGIN PGP SIGNED MESSAGE-----
What you are seeing is normal for roo-1.x. We are working on the
next generation Honeywall that will hopefully offer options to do
more selective data capture (and other cool stuff). i.e. Only
perform data capture to/from Honeypots (or even selected honeypots)
as one example.
On Tue, 03 Oct 2006 11:46:12 -0400 "mng3 (at) libero (dot) it [email concealed]"
<mng3 (at) libero (dot) it [email concealed]> wrote:
>I'm configuring a little honeynet: the Honeywall and one honeypot
>running WinXP Pro SP2.
>I have deployed the honeynet in my LAN, so the honeypot is in the
>same subnet of my production system.
>My doubt is the following: the Walleye web interface, in the "Top
>10 Honeypots" section show not only honeypot's IP address, but
>also IP address of some production systems.
>Moreover, when I examine the connection tracked by Honeywall, I
>see also connections between system that are NOT the honeypot.
>Is this behaviour normal?
>The Honeywall are working fine?
>Salva ora il tuo preventivo Direct Line e assicurati lo sconto
>extra 5+5% sulla polizza auto entro il 31 Ottobre!
-----BEGIN PGP SIGNATURE-----
Note: This signature can be verified at https://www.hushtools.com/verify
Version: Hush 2.5
-----END PGP SIGNATURE-----
[ reply ]
Copyright 2010, SecurityFocus