Re: Error running Honeyd-WIN32

["Roger A. Grimes" <roger () banneretcs com>]

The Impossible SI range message is not a critical one and refers to an
invalid entry in the nmap.prints file.  The second one is one I've been
trying to troubleshoot lately along with Niels Provos and Michael Davis
(porter of Honeyd-Win32).  We haven't discovered the problem yet, but I'm
wondering if it has to do with one of the following:

1.  The new version of Winpcap
2.  Windows 2000 and above (as I don't get the message in my Win98 boxes),
using the same network cards.

What can be more befuddling on the latter message is that running the -W
parameter shows the NIC as discovered by Winpcap, and then Honeyd doesn't
find it.

Any help from the list would be appreciated and I'll send a free autograph
copy of my forthcoming book to the first correct replier (yeah, the
autograph makes it worth at least $0.01 more than without it).

Roger

****************************************************************************
****
*Roger A. Grimes, Computer Security Consultant
*CPA, MCSE:Security (NT/2000/2003/MVP), CNE (3/4), A+
*email: roger () banneretcs com
*cell: 757-615-3355
*Author of Malicious Mobile Code:  Virus Protection for Windows by O'Reilly
*http://www.oreilly.com/catalog/malmobcode
*Author of upcoming Honeypots for Windows (Apress)
****************************************************************************
*****

----- Original Message ----- 
From: "FreeCC" <freecc () eyou com>
To: <honeypots () securityfocus com>
Sent: Saturday, February 28, 2004 12:36 AM
Subject: Error running Honeyd-WIN32


> I am using the Honeyd-WIN32 from
> http://www.securityprofiling.com.
> I got this error while running it.
> Started honeyd using "honeyd -d -f config.sample"
> But it didn't work.This is what it said:
> Impossible SI range in Class fingerprint "Windows NT 4 SP3"
> intf_get: No such device or address
>
> I followed the instructions at the WIN32_README.txt. Any ideas
> what happened?
> Thank you for your patience.
>
> FreeCC
>
>
>
>
>
> --http://www.eyou.com
> --Îȶ¨¿É¿¿µÄµç×ÓÐÅÏä  ÓïÒôÓʼþ  Òƶ¯ÊéÇ©  ÈÕÀú·þÎñ  ÍøÂç´æ´¢...ÒÚÓÊδ¾¡
>
> --http://vip.eyou.com
> --¿ì¿ìµÇ¼ÒÚÓÊVIPÐÅÏä  ×¢²áÄúÖÐÒâµÄÓû§Ãû