honeyd compile error 1.0 and 0.8b
Ivan Rivera <[email protected]>
| Newsgroups | gmane.comp.security.honeypots |
|---|---|
| Message-ID | <[email protected]> |
Hi I try to compile different version of honeyd (1.0 and 0.8b). I compile and install the following software libdnet 1.10 (OK) libevent 1.0c (OK) libpcap 0.8.3 (OK) I run ldconfig in the directory of libdnet and when I try to compile honeyd i get the following error message. checking for working addr_cmp in libdnet... configure: error: you need to install a more recent version of libdnet I specify the --with-libdnet=/usr/local but i get the same error message. I check documentation but all the documentation do not say anything about this error, I think is a commond error message, and i apply all the steps that i found in the internet to fix this problem but I do not get the right compile Why I need to install another version more recent that i have in my computer? I use 1.10 Do you have any idea? Thanks for you help Ivan --- James Oliver <[email protected]> wrote: > Hi, > > I'm running honeyd (1.0) with a host based on the > "Linux 2.4.20" > personality. A firewall (iptables 1.2.9) drops all > new outgoing > connections. When I try to ping this Linux host from > outside the > firewall always drops the packet, stating this is a > new connection. > > I have analysed the ICMP Echo Replies honeyd sends > for the "Linux > 2.4.20" personality and the Code field is set to 1, > even if the ICMP > Echo Request's Code field is 0. > > In > http://www.networkmagazine.com/shared/printableArticle.jhtml?articleID=8702910 > it is stated that Linux doesn't change the code > field, so I'm > wondering why this happens. I have analysed my own > ICMP Echo > Requests/Replies and looked at > /usr/src/linux/net/ipv4/icmp.c to have > a look at the Linux ICMP code. This code is the same > as the one in the > Linux 2.4.20 sources, so the behaviour should be the > same AFAIK. > > Therefore I have now modified my > /usr/share/honeyd/xprobe2.conf in line 237 to > > icmp_echo_code = 0 > > instead of > > icmp_echo_code = !0 > > After this change the firewall accepts the ICMP Echo > Replies of > honeyd's Linux 2.4.20 personality. Nevertheless it > now always changes > the ICMP Echo Replie Code always to 0 which is not > Linux behaviour. > > Is the behavior in the original xprobe2.conf > intended? Is there a > mistake on my side? > > Thanks for your suggestions, > James > IvAn =^) [email protected]