Honeypots mailing list archives

openBSD: bad pcap filter


From: Joshua James Donkersloot <jdonker () EE UManitoba CA>
Date: Mon, 19 Jul 2004 10:28:41 -0500

Hi,
        I am not sure if this has been answered before because I am new to this
mailing list.  I am trying to setup honeyd on an openBSD box using
DHCP.  I would like to have honeyd listen to the loopback interface
(lo0).  When I try to launch honeyd on this interface I get an error as
shown in the output below. 

###############   OUTPUT  ######################

noed02# honeyd -i lo0
Honeyd V0.8b Copyright (c) 2002-2004 Niels Provos
honeyd[12299]: started with -i lo0
Warning: Impossible SI range in Class fingerprint "IBM OS/400 V4R2M0"
Jul 18 03:17:41 noed02 honeyd[12299]: started with -i lo0
Warning: Impossible SI range in Class fingerprint "Microsoft Windows NT
4.0 SP3"honeyd: unsupported datalink type
honeyd[12299]: listening on lo0: ip
honeyd: bad pcap filter: unknown data link type 12

##############   END OUTPUT  ####################

        If I launch honeyd on interface de0 (my ethernet card) it seems to
launch correctly.  If anyone knows why i might be getting this bad pcap
filter error or how to correct it please let me know.  Any help would be
greatly appreciated.

Thank-you,

              Josh



Current thread: