Arpd and DHCP USER_IN_DEF_WHITELIST autolearn=ham version=2.63

From: Graeme Connell <gconnell_at_middlebury.edu>
Date: 14 Apr 2004 23:24:53 -0000

('binary' encoding is not supported, stored as-is) I'm proposing a small set of honeypots on my network, all with honeyd and using arpd for redirection to the honeyd machine. The network relies very much on dhcp, and a question recently came up about the interaction between honeyd and arpd. It went something like this:

  If an attacker is connecting to 192.168.0.1, and another computer comes online,
  a) will dhcp still serve out the address 192.168.0.1?
  b) will honeyd and arpd disrupt services for this newly connected user until arpd releases the address?

Any help here would be great.

   --Graeme Connell
Received on Wed Apr 14 2004 - 20:46:16 PDT