Monkey.org Developments
Honeyd Mailing List

Support Honeyd

Search:
Keywords:

Search Amazon

 
 

Uncertainities about router configuration in honeyd

From: Markus Schabel <markus.schabel_at_tgm.ac.at>
Date: Tue, 25 May 2004 23:38:14 +0200

If I create the following configuration and do some traceroutes to find
out the layout of the network I'm not sure whether I got all things
correct or not...

> route entry 192.168.0.1
> route 192.168.0.1 link 192.168.0.0/24
>
> create default
> set default default tcp action block
> set default default udp action block
> set default default icmp action block
>
> create router
> set router personality "Cisco 3600 router running IOS 12.2(6c)"
>
> create solaris
> set solaris personality "Sun Solaris 2.6"
>
> bind router 192.168.0.1
> bind solaris 192.168.0.2

What does the phrase "entry point" exactly means? Is it like the
following scheme:

     +---+ +---+
     | | | |
     +---+ +---+
    +-----+ +-----+
    +-----+ +-----+
       | .? ?.?.?.? .? (-) .1 192.168.0.0/24 .3 |
     --+------------------( X )------------------------+
        [which network?] (-)
(me_at_localhost, (entry point,
loopback int) router)
[which IP?] [which IP?]

Is it correct that the 192.168.0.0 network is behind the router? Which
network is in front of the router (especially if I use the loopback
interface)?

If I change the configuration to the following:

> route entry 192.168.0.1
> route 192.168.0.1 link 192.168.0.0/24
> route 192.168.0.1 link 192.168.1.0/24
> [..]

I get the following:

     +---+ +---+
     | | | |
     +---+ +---+
    +-----+ +-----+
    +-----+ 192.168.1.0/24 +-----+
       | .? ?.?.?.? .? (-) .1 192.168.0.0/24 .3 |
     --+------------------( X )------------------------+
                           (-)

Is it possible to configure honeyd to simulate the following (an
additional network attached to the router):

     +---+ 192.168.1.0/24 +---+
     | | +------------------ | |
     +---+ | +---+
    +-----+ | +-----+
    +-----+ | +-----+
       | .? ?.?.?.? .? (-) .1 192.168.0.0/24 .3 |
     --+------------------( X )------------------------+
                           (-)

If I add other routers to the network like the following:

> route entry 192.168.0.1
> route 192.168.0.1 link 192.168.0.0/24
> route 192.168.0.1 add net 192.168.2.0/24 192.168.2.1
> route 192.168.2.1 link 192.168.2.0/24
> [..]
> bind router 192.168.0.1
> bind router 192.168.2.1

I get the following:

     +---+
     | |
     +---+
    +-----+
    +-----+
       | (-) .1 .? (-) .1
     --+------( X )----------------( X )----------------
               (-) 192.168.0.0/24 (-) 192.168.2.0/24

What is the first (left) IP address of the second router? Is that router
connected over the 192.168.0.0 network or directly attached to the first
one?

If I go further and add another router here:

> route entry 192.168.0.1
> route 192.168.0.1 link 192.168.0.0/24
> route 192.168.0.1 add net 192.168.2.0/24 192.168.2.1
> route 192.168.0.1 add net 192.168.4.0/24 192.168.4.1
> route 192.168.2.1 link 192.168.2.0/24
> route 192.168.4.1 link 192.168.4.0/24
> [..]
> bind router 192.168.0.1
> bind router 192.168.2.1
> bind router 192.168.4.1

I get the following:

     +---+ .? (-) .1
     | | +----( X )-------------------
     +---+ | (-) 192.168.4.0/24
    +-----+ |
    +-----+ |
       | (-) .1 | .? (-) .1
     --+------( X )--------+-------( X )----------------
               (-) 192.168.0.0/24 (-) 192.168.2.0/24

But shouldn't look it like the following:

     +---+ .? (-) .1
     | | +---------------( X )-------------------
     +---+ | (-) 192.168.4.0/24
    +-----+ |
    +-----+ |
       | (-) .1
     --+------( X )-------------------------------------
               (-) 192.168.0.0/24
                |
                |
                | .? (-) .1
                +---------------( X )-------------------
                                 (-) 192.168.2.0/24

Hopefully somebody can get some light into all this stuff...

Is there anywhere a _good_ howto about this topic?

thanks & best regards
Markus

-- 
           \\\ ||| ///                               _\=/_
            (  @ @  )                                (o o)
+--------oOOo-(_)-oOOo--------------------------oOOo-(_)-oOOo------+
| Markus Schabel      TGM - Die Schule der Technik   www.tgm.ac.at |
| IT-Service          A-1200 Wien, Wexstrasse 19-23  net.tgm.ac.at |
| markus.schabel_at_tgm.ac.at                   Tel.: +43(1)33126/316 |
| markus.schabel_at_members.fsf.org             Fax.: +43(1)33126/154 |
| FSF Associate Member #597, Linux User #259595 (counter.li.org)   |
|        oOOo        Yet Another Spam Trap:     oOOo               |
|       (    )    oOOo    yast_at_tgm.ac.at       (   )     oOOo      |
+--------\  (----(   )--------------------------\ ( -----(   )-----+
           \_)     ) /                            \_)      ) /
                  (_/                                     (_/
Computers are like airconditioners:
   They stop working properly if you open windows.
Received on Tue May 25 2004 - 19:16:02 PDT
Search For Information
Google
Search WWW Search www.honeyd.org

NB: This is a filtered version of the Honeypots mailing list. Only posts that concern Honeyd are shown here. For more recent discussions visit the forums.