From owner-freebsd-security  Thu Sep 27 10: 1:45 2001
Delivered-To: freebsd-security@freebsd.org
Received: from lariat.org (lariat.org [12.23.109.2])
	by hub.freebsd.org (Postfix) with ESMTP id 25E8E37B6DA
	for <security@FreeBSD.ORG>; Thu, 27 Sep 2001 10:01:38 -0700 (PDT)
Received: from mustang.lariat.org (IDENT:ppp0.lariat.org@lariat.org [12.23.109.2])
	by lariat.org (8.9.3/8.9.3) with ESMTP id LAA15297;
	Thu, 27 Sep 2001 11:01:25 -0600 (MDT)
Message-Id: <4.3.2.7.2.20010927105751.046e2440@localhost>
X-Sender: brett@localhost
X-Mailer: QUALCOMM Windows Eudora Version 4.3.2
Date: Thu, 27 Sep 2001 11:01:12 -0600
To: Laurent Fabre <fabre@matranet.com>
From: Brett Glass <brett@lariat.org>
Subject: Re: LaBrea for BSD?
Cc: Will Andrews <will@physics.purdue.edu>,
	FreeBSD Security <security@FreeBSD.ORG>
In-Reply-To: <200109271500.RAA09268@malraux.matranet.com>
References: <20010924162750.24311@shalmaneser.thelbane.com>
 <4.3.2.7.2.20010925105333.04794430@localhost>
 <200109261355.PAA27232@malraux.matranet.com>
 <200109261904.VAA21740@malraux.matranet.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

At 09:05 AM 9/27/2001, Laurent Fabre wrote:

>I thought about it yup but....
>The fact is I need to capture something lower than IP, just because
>we need to monitor ARP request in order to acquire new IP addresses.

Automatic acquisition of unused IPs is, IMHO, a bad idea. If you're
assigning addresses via DHCP, it just plain won't work; the honeypot
will acquire addresses that your DHCP server still thinks can be
assigned. And since every Windows client tries to ARP its own address
as it starts up (in an attempt to make sure it's not stepping on
someone else), a machine that has been turned off for the night
will refuse to get on the Net in the morning if its address has
been claimed. 

I'd prefer to specify the addresses to watch, thank you....

--Brett


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message