s14

root@honeypot honeyd# arpd -d 10.0.0.4-10.0.0.254

arpd[6051]: listening on ethO: arp and (dst net 10.0.0.4/30 or dst net 10.0.0.8/29 or dst net 10.0.0.16/28 o r dst net 10.0.0.32/27 or dst net 10.0.0.64/26 or dst net 10.0.0.128/26 or dst net 10.0.0.192/27 or dst net 10.0.0.224/28 or dst net 10.0.0.240/29 or dst net 10.0.0.248/30 or dst net 10.0.0.252/31 or dst net 10.0.0.2 54/32) and not ether src 00:00:39:af:68:f7 arpd[6051): arpd_lookup: no entry for 10.0.0.123 arpd[6051): arpd_send: who-has 10.O.O.123 tell 10.0.0.2 arpd[6051): arpd_send: who-has 10.O.O.123 tell 10.0.0.2 arpd[6051): arpd_recv_cb: 10.0.0.123 still discovering (2) arpd[6051): arp reply 10.0.0.123 is-at 00:00:39:af:68:f7 □

:_

File Edit View lerminal Tabs Help

root@honeypot honeyd# honeyd -d -u O -g O -f config2 10.0.0.4-10.0.0.254 Honeyd V0.8b Copyright (c) 2002-2004 Niels Provos

honeyd!6052]: started with -d -u O -g O -f config2 10.0.0.4-10.0.0.254 Warning: Impossible SI rangę in Class fingerprint "IBM 0S/400 V4R2M0"

Warning: Impossible SI rangę in Class fingerprint "Microsoft Windows NT 4.0 SP3"

honeyd!6052]: listening promiscuously on ethO: (arp or ip proto 47 or (ip and (dst net 10.0.0.4/30 or dst ne

t 10.0.0.8/29 or dst net 10.0.0.16/28 or dst net 10.0.0.32/27 or dst net 10.0.0.64/26 or dst net 10.0.0.128/

26 or dst net 10.0.0.192/27 or dst net 10.0.0.224/28 or dst net 10.0.0.240/29 or dst net 10.0.0.248/30 or ds

t net 10.0.0.252/31 or dst net 10.0.0.254/32))) and not ether src 00:00:39:af:68:f7

honeyd!6052]: Demoting process privileges to uid O, gid O

honeyd!6052]:    Sending    ICMP    Echo    Reply:    10.0.0.123    ->    10.0.0.3

honeyd!6052]:    Sending    ICMP    Echo    Reply:    10.0.0.123    ->    10.0.0.3

honeyd!6052]:    Sending    ICMP    Echo    Reply:    10.0.0.123    ->    10.0.0.3

honeyd!6052]:    Sending    ICMP    Echo    Reply:    10.0.0.123    ->    10.0.0.3

honeyd!6052]: Killing attempted connection: tcp (10.0.0.3:32770 - 10.0.0.123:22) honeyd!6052]: Connection request: tcp (10.0.0.3:32771 - 10.0.0.123:135) honeyd!6052]: Connection established: tcp (10.0.0.3:32771 - 10.0.0.123:135) honeyd!6052]: Connection closed: tcp (10.0.0.3:32771 - 10.0.0.123:135) honeyd!6052]: Connection request: tcp (10.0.0.3:32772 - 10.0.0.123:445) honeyd!6052]: Connection established: tcp (10.0.0.3:32772 - 10.0.0.123:445) honeyd!6052]: Connection closed: tcp (10.0.0.3:32772 - 10.0.0.123:445)

□