Honeypots mailing list archives
Re: nepenthes for multiple ip addresses
From: Gergely Révay <gergely.revay () gmail com>
Date: Sun, 19 Apr 2009 17:11:38 +0200
Hi, If there is no address translation in the routing process then you should have alias interfaces for those IPs which you want to listen on. For instance if the 192.168.1.0/24 network is redirected to your computer then you should use a command like this: $ for i in `seq 2 254`; do sudo ip addr add 192.168.1.$i/24 brd + dev eth0; done (or something :) ) In this case when nepenthes listens on 0.0.0.0 then it means it listen on the alias IPs as well. If there is address translation in the routing then those packet should have your IP as their destination IP and then it should work. If you don't know you can check it with tcpdump. I hope I helped. Good luck! Geri 2009/4/18 Viktor <gecko003 () gmail com>:
Hello! I'm running nepenthes on a debian OS at an universiry network with a fix IP. I managed to get a high number of unused IP addresses from the university network administrator, all traffic from these are routed to my computer. Now i'm having 200 packet/s income rate, but nepenthes only looks for the traffic addressed to my own IP. Is there a way to make nepenthes listening for all incoming packets despite the packet destination IP is not mine? I have a lot of IPs, and they are random, changing every time, so it's not an option to give alternate IPs to my interface. Thanks in advance! Viktor
Current thread:
- nepenthes for multiple ip addresses Viktor (Apr 18)
- Re: nepenthes for multiple ip addresses Sushant Sinha (Apr 18)
- Message not available
- Re: nepenthes for multiple ip addresses Viktor (Apr 19)
- Message not available
- Re: nepenthes for multiple ip addresses Sushant Sinha (Apr 18)
- Re: nepenthes for multiple ip addresses Gergely Révay (Apr 19)