Honeypots mailing list archives

Unwanted traffic in honeynet


From: "Martin Kristensen" <martink () student hin no>
Date: Tue, 19 Apr 2005 11:37:56 +0200

Hello everyone
I thought the public_ip value set in the firewall scripts would stop traffic
that wasn't ment for the honeynet.
Our honeypots have public ip's like xxx.xx.124.14 and xxx.xx.124.15 with a
broadcast adress of xxx.xx.125.255.
The 124 and 125 net are the same so that the prefix would be xxx.xx.125/24
But we're getting unwanted traffic in our snort logs. Traffic that were ment
for other computers on the same lan, like xxx.xx.124.89
Have we configured something wrong in the scripts? Anyone experienced the
same?

Regards

Martin and Elena


Current thread: