From owner-freebsd-security  Mon Mar 25 10: 6:45 2002
Delivered-To: freebsd-security@freebsd.org
Received: from caerulus.cerintha.com (caerulus.cerintha.com [207.18.92.26])
	by hub.freebsd.org (Postfix) with ESMTP id 789EA37B404
	for <security@freebsd.org>; Mon, 25 Mar 2002 10:06:39 -0800 (PST)
Received: from MIKELT ([216.241.67.81])
	by caerulus.cerintha.com (8.11.3/8.11.3) with SMTP id g2PI6WR14128
	for <security@freebsd.org>; Mon, 25 Mar 2002 13:06:33 -0500 (EST)
Message-ID: <001e01c1d427$cbf61640$2801010a@MIKELT>
From: "Michael Scheidell" <scheidell@secnap.net>
To: <security@freebsd.org>
Subject: LaBrea on FBSD 4.5 not working?
Date: Mon, 25 Mar 2002 13:06:32 -0500
Organization: Secnap Network Security, LLC.
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.50.4807.1700
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4910.0300
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

Trying to get LaBrea running on FBSD 4.5.

(yes, I used the -z option)

It starts (or doesn't? doesn't show up in ps or ps -uroot)
killall will kill it.
/var/log/messages shows it changing promis mode on interface.

it should emulate an interface on unused ips (respond to pings) and capture
connections.
ping to unused ip failes, doesn't show up in log.
telnet or http connection to unused ip failes and doesn't show up in log.
have latest csv of ports and libpcap.

What did I do wrong?
--
Michael Scheidell


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message