Honeypots mailing list archives

Arpd and DHCP


From: Graeme Connell <gconnell () middlebury edu>
Date: 14 Apr 2004 23:24:53 -0000



I'm proposing a small set of honeypots on my network, all with honeyd and using arpd for redirection to the honeyd 
machine.  The network relies very much on dhcp, and a question recently came up about the interaction between honeyd 
and arpd.  It went something like this:

  If an attacker is connecting to 192.168.0.1, and another computer comes online, 
  a) will dhcp still serve out the address 192.168.0.1?
  b) will honeyd and arpd disrupt services for this newly connected user until arpd releases the address?

Any help here would be great.

   --Graeme Connell


Current thread: