Re: Very frustrated with Honeyd......

[Javier Fernandez-Sanguino <jfernandez () germinus com>]

Mr.Konfess0r wrote:

> "honeyd -f win2k -a nmap.prints -i eth0"
>
> and I receive the following messages:
>
> ====================================================================
> Warning: Impossible SI Range in Class Fingerprint "IBM OS/400 V4R2MO"
> Warning: Impossible SI Range in Class Fingerprint "Microsof Windows NT 4.0 SP3"

Your nmap.prints file is not understood by honeyd. You should maybe 
stick with the one provided by honeyd?

> Honeyd[2348]: Listening promiscuously on Eth0: arp or ip proto 47 or (udp and src port 62 and dest port 68) or (IP )) 
> and not ether src (my mac address)
> Honeyd: make_socket_ai:address already in use
> Honeyd: pyextend_webserver_init: make_socket:address already in use

That's because you are using honeyd version 1.0 which includes a 
webserver and you already have a webserver running in your system. 
Just run it with --disable-webserver and it should work. Check out the 
manpage honeyd(8).

Granted, the error message could be a little bit less cryptic....

Regards

Javier