Honeypots mailing list archives
Re: openBSD: bad pcap filter
From: chakl () syscall de (Olaf Schreck)
Date: Tue, 20 Jul 2004 12:07:45 +0200
Josh,
I would like to have honeyd listen to the loopback interface (lo0). When I try to launch honeyd on this interface I get an error as shown in the output below.
honeyd: unsupported datalink type honeyd[12299]: listening on lo0: ip honeyd: bad pcap filter: unknown data link type 12
This error comes from the pcap library, not from honeyd itself. Honeyd uses this library to pull packet from the interfaces. Pcap says it does not understand data link type 12 (DLT_LOOP). What version of OpenBSD are you running? Did you compile libpcap from source instead of using the one that comes with the system? A quick check with OpenBSD 3.2 and 3.5 shows that type 12 / DLT_LOOP should be recognized by the system libpcap. Another check on Linux (which uses LBNL's libpcap) shows that type 12 being DLT_RAW there, so it seems there are significant differences in the that part of the libpcap code. Anyway, this error should not show up in native OpenBSD. I don't really understand the reasoning to put honeyd on the loopback interface. Loopback interfaces are somewhat special in OpenBSD, you should not do what you're trying to achieve unless you can deal with the errors yourself. ciao, chakl -- Olaf Schreck chakl () syscall de syscall() Network Solutions, Berlin
Current thread:
- openBSD: bad pcap filter Joshua James Donkersloot (Jul 19)
- Re: openBSD: bad pcap filter Olaf Schreck (Jul 20)