s40

File Edit View lerminal Tabs Help

root@honeypot honeyd# arpd -d 10.0.0.4-10.0.0.254

arpd[6301]: listening on ethO: arp and (dst net 10.0.0.4/30 or dst net 10.0.0.8/29 or dst net 10.0.0.16/28 or ds t net 10.0.0.32/27 or dst net 10.0.0.64/26 or dst net 10.0.0.128/26 or dst net 10.0.0.192/27 or dst net 10.0.0.2 24/28 or dst net 10.0.0.240/29 or dst net 10.0.0.248/30 or dst net 10.0.0.252/31 or dst net 10.0.0.254/32) and n ot ether src 00:00:39:af:68:f7

arpd[6301): arpd_lookup: no entry for 10.0.0.150 arpd[6301): arpd_send: who-has 10.O.O.150 tell 10.0.0.2 arpd[6301): arpd_send: who-has 10.O.O.150 tell 10.0.0.2 arpd[6301): arp reply 10.0.0.150 is-at 00:00:39:af:68:f7 □

:_

File Edit View lerminal Tabs Help

root@honeypot honeyd# honeyd -d -u O -g O -f config4 10.0.0.4-10.0.0.254 Honeyd V0.8b Copyright (c) 2002-2004 Niels Provos

honeyd!6302]: started with -d -u O -g O -f config4 10.0.0.4-10.0.0.254 Warning: Impossible SI rangę in Class fingerprint "IBM 0S/400 V4R2M0"

Warning: Impossible SI rangę in Class fingerprint "Microsoft Windows NT 4.0 SP3"

honeyd!6302]: listening promiscuously on ethO: (arp or ip proto 47 or (ip and (dst net 10.0.0.4/30 or dst net 10

.0.0.8/29 or dst net 10.0.0.16/28 or dst net 10.0.0.32/27 or dst net 10.0.0.64/26 or dst net 10.0.0.128/26 or ds

t net 10.0.0.192/27 or dst net 10.0.0.224/28 or dst net 10.0.0.240/29 or dst net 10.0.0.248/30 or dst net 10.0.0

.252/31 or dst net 10.0.0.254/32))) and not ether src 00:00:39:af:68:f7

honeyd!6302]: Demoting process privileges to uid O, gid O

honeyd!6302]: Connection request: tcp (10.0.0.1:1033 - 10.0.0.150:4444)

honeyd!6302]: Connection established: tcp (10.0.0.1:1033 - 10.0.0.150:4444) <-> /bin/sh scripts/MSBlaster_Cleane r.sh 10.0.0.1 10.0.0.150

honeyd!6302]: Expiring TCP (10.0.0.1:1033 - 10.0.0.150:4444) (0x832ale0) in state 5

□