Re: Is it one way to detect honeypot?

Fred,

> Hi All,
>
> I am running honeyd with arpd. It can answer with unused IP. However,
> when I use some programs to check the MAC address of virtual
> hosts(unused IP), it always answer with the MAC address of honeyd
> host.
Yes, HoneyD uses the hosts MAC address.

>
> By looking at the MAC address, all the MAC are the same! Is it one way
> to detect honeypot?
Yes, Run Hunt in the LAN, you will find the machines spoofing the MAC.
ArpWatch will help you a lot.

> Anything to hide my honeypot?
Me too dont know how to hide from LAN PCs. If the attacker is from
Internet, there is no simple way to find.
Ravi
ROCSYS technologies Ltd
http://www.rocsys.com
>
> Thanks!
>
> Best,
> Fred
>
> 必殺技、飲歌、小星星...
> 浪漫鈴聲 情心連繫
> http://ringtone.yahoo.com.hk/
Received on Fri Feb 13 2004 - 00:36:34 PST