honeyd的安装与使用

wantfly 发表于 2011-12-22 08:53

<span style="font-family:宋体;mso-ascii-font-family:
Calibri;mso-ascii-theme-font:minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:
minor-fareast;mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">参照以下文档很顺利地安装好了honeyd<span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">。不过有些小问题在这备注一下，另外也增加了一些文档中作者没有讲到的问题。在当向netcat致敬，没有他的文档，我不可能这么顺利的完成这个case. 

 

1． <span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">系统采用Redhat
AS 5 update 4<span style="font-family:宋体;mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:
minor-fareast;mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">完全安装版。

2． <span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">原文中libdnet-1.11.tar.gz<span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">的下载地址有问题，不过地址还是包括在它的链接里面的。

3． <span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">对安装顺序作一个重新安排

a.       <span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">安装libpcap-1.1.1.tar.gz<span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">包

b.      <span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">安装libdnet-1.11.tar.gz<span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">包

c.       <span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">安装libevent-1.4.14b-stable.tar.gz<span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">包

d.      <span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">最后再安装honeyd<span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">包。在这里我并没有安装文中所提到的readline
readline-devel<span style="font-family:宋体;mso-ascii-font-family:
Calibri;mso-ascii-theme-font:minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:
minor-fareast;mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">这两个包。但也没有出过文中所讲的错误。我用rpm
–qa<span style="font-family:宋体;mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:
minor-fareast;mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">查找过类似名称的包，也没有找到。不知道是不是与我安装的系统版本有关系

e.      <span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">最后安装arpd<span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">包，文中所讲的确实有用，还没来得及深究为什么要这样作.

4． <span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">上面所有软件包安装完成后，在命令行下运行arpd<span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">命令，只要没出现listening
on eth0<span style="font-family:宋体;mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:
minor-fareast;mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">之类的提示就证明是有问题的：

# arpd

arpd: listening on eth0: arp  and not ether src 00:0c:29:89:a8:aa

 

<span style="font-family:宋体;mso-ascii-font-family:
Calibri;mso-ascii-theme-font:minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:
minor-fareast;mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">解决方法就如文中所讲，用find<span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">命令找到所需要的so<span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">文件，然后拷贝到/usr/lib<span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">下面即可。

<span style="font-family:宋体;mso-ascii-font-family:
Calibri;mso-ascii-theme-font:minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:
minor-fareast;mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">我在这里缺少两个文件，这两个文件就是上面两个软件包安装后产生的，默认不会放到/usr/lib<span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">下，其实应该也可以在安装前通过修改configure<span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">文件达到这个目的。不过拷贝也很简单了.

 

5． <span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">根据文档，创建两个log<span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">文件后，使用honeyd
-d -l /var/log/honeyd/honeyd.log -s /var/log/honeyd/service.log
--fix-webserver-permissions 192.168.119.100<span style="font-family:
宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:minor-latin;mso-fareast-font-family:
宋体;mso-fareast-theme-font:minor-fareast;mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin" lang="ZH-CN">命令可以在网络中虚拟出一个192.168.119.100<span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">的虚拟主机来：

# honeyd -d -l
/var/log/honeyd/honeyd.log -s /var/log/honeyd/service.log
--fix-webserver-permissions 192.168.119.100

Honeyd V1.5c Copyright (c)
2002-2007 Niels Provos

honeyd: started with -d -l
/var/log/honeyd/honeyd.log -s /var/log/honeyd/service.log
--fix-webserver-permissions 192.168.119.100

Warning: Impossible SI range in
Class fingerprint "IBM OS/400 V4R2M0"

Warning: Impossible SI range in
Class fingerprint "Microsoft Windows NT 4.0 SP3"

honeyd: listening
promiscuously on eth0: (arp or ip proto 47 or (udp and src port 67 and dst port
68) or (ip and (host 192.168.119.100))) and not ether src 00:0c:29:89:a8:aa

 

 

<span style="font-family:
宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:minor-latin;mso-fareast-font-family:
宋体;mso-fareast-theme-font:minor-fareast;mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin" lang="ZH-CN">在客户端分别使用ping ,ftp, telnet<span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">命令后会在服务端产生如下连接日志：

honeyd: Sending ICMP Echo
Reply: 192.168.119.100 -> 192.168.119.30

honeyd: Sending ICMP Echo
Reply: 192.168.119.100 -> 192.168.119.30

honeyd: Sending ICMP Echo
Reply: 192.168.119.100 -> 192.168.119.30

honeyd: Sending ICMP Echo
Reply: 192.168.119.100 -> 192.168.119.30

 

honeyd: Connection request:
tcp (192.168.119.30:64332 - 192.168.119.100:21)

honeyd: Connection
established: tcp (192.168.119.30:64332 - 192.168.119.100:21)

honeyd: Connection dropped
by reset: tcp (192.168.119.30:64332 - 192.168.119.100:21)

 

honeyd: Connection request:
tcp (192.168.119.30:64359 - 192.168.119.100:23)

honeyd: Connection
established: tcp (192.168.119.30:64359 - 192.168.119.100:23)

honeyd: Connection closed:
tcp (192.168.119.30:64359 - 192.168.119.100:23)

honeyd: Killing unknown
connection: tcp (192.168.119.30:64359 - 192.168.119.100:23)

 

 

6． <span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">系统安装好后，主要的文件有：

a.       <span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">执行文件：

# ll
/usr/local/bin/h*

-rwxr-xr-x 1 root root
958160 Jun 10 06:48 /usr/local/bin/honeyd

-rwxr-xr-x 1 root root  32810 Jun 10 06:48 /usr/local/bin/honeydctl

-rwxr-xr-x 1 root root
202203 Jun 10 06:48 /usr/local/bin/honeydstats

-rwxr-xr-x 1 root root 194658
Jun 10 06:48 /usr/local/bin/hsniff

 

b.      <span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">配置文件：默认的配置文件都放在/usr/local/share/honeyd<span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">目录下的

# ll
/usr/local/share/honeyd

total 592

-rw-r--r-- 1 root root    247 Jun 10 06:48 config.ethernet

-rw-r--r-- 1 root root   1226 Jun 10 06:48 config.sample

-rw-r--r-- 1 root root  45556 Jun 10 06:48 nmap.assoc

-rw-r--r-- 1 root root
451138 Jun 10 06:48 nmap.prints

-rw-r--r-- 1 root root  28312 Jun 10 06:48 pf.os

-rw-r--r-- 1 root root   4130 Jun 10 06:48 README

drwxrwxrwx 3  501 
501   4096 May 28  2007 webserver

-rw-r--r-- 1 root root  45207 Jun 10 06:48 xprobe2.conf

 c.       <span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">进程文件：

/var/run/honeyd.sock

/var/run/honeyd.pid

d.      <span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">日志文件：

<span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;mso-hansi-font-family:
Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">这个在文档中是自己定义位置的，查看其它文档也有介绍可以使用syslog<span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">之类的日志系统.

7． <span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">可以使用下载的honeyd_kit<span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">软件包来快速使用honeyd,
<span style="font-family:宋体;mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:
minor-fareast;mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">在使用前务必先看一下README<span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">文档，根据你的网络更改一下.<span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">主要有三个文件

honeyd.conf , start-arpd.sh, start-honeyd.sh  

<span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;mso-hansi-font-family:
Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">以下是我这三个配置文件的内容：

[root@portaltest
honeyd_kit-1.0c-a]# cat honeyd.conf                #####  Honeyd Configuration File #####

                 # Last Updated: 31 May, 2005

 #####################################################################

### Start with default
template.  If you don't assign
specifc     ###

### behavior to a specific
honeypot, it defaults to the 'default' ###

### template.  You must have a template with the name
'default'.  ###

#####################################################################

 

### Default Template

create default

set default personality
"Microsoft Windows XP Home Edition"

set default default tcp
action reset

set default default udp
action reset

set default default icmp
action open

add default tcp port 80
"sh scripts/misc/test.sh"

add default tcp port 139
open

add default tcp port 137
open

add default udp port 137
open

add default udp port 135
open

add default udp port 445
open

add default tcp port 445
open

 

### Standard Windows 2000
computer

create win2k

set win2k personality
"Microsoft Windows 2000 Server SP3"

set win2k default tcp
action reset

set win2k default udp
action reset

set win2k default icmp
action block

set win2k uptime 3567

set win2k droprate in 13

add win2k tcp port 21
"sh scripts/win32/win2k/msftp.sh $ipsrc $sport $ipdst $dport"

add win2k tcp port 25
"sh scripts/win32/win2k/exchange-smtp.sh $ipsrc $sport $ipdst $dport"

add win2k tcp port 80
"sh scripts/win32/win2k/iis.sh $ipsrc $sport $ipdst $dport"

add win2k tcp port 110
"sh scripts/win32/win2k/exchange-pop3.sh $ipsrc $sport $ipdst $dport"

add win2k tcp port 143
"sh scripts/win32/win2k/exchange-imap.sh $ipsrc $sport $ipdst $dport"

add win2k tcp port 389
"sh scripts/win32/win2k/ldap.sh $ipsrc $sport $ipdst $dport"

add win2k tcp port 5901
"sh scripts/win32/win2k/vnc.sh $ipsrc $sport $ipdst $dport"

add win2k udp port 161
"perl scripts/unix/general/snmp/fake-snmp.pl public private --config=scripts/unix/general"

# This will redirect
incomming windows-filesharing back to the source

add win2k udp port 137
proxy $ipsrc:137

add win2k udp port 138
proxy $ipsrc:138

add win2k udp port 445
proxy $ipsrc:445

add win2k tcp port 137
proxy $ipsrc:137

add win2k tcp port 138
proxy $ipsrc:138

add win2k tcp port 139
proxy $ipsrc:139

add win2k tcp port 445
proxy $ipsrc:445

bind 192.168.115.201 win2k

bind 192.168.114.201 win2k

 ============================================

[root@portaltest
honeyd_kit-1.0c-a]# cat start-arpd.sh 

#!/bin/sh

#

# Aprd startup script.

# Marcus Ranum/Lance
Spitzner 3 Jan, 2003

#

# PURPOSE: To start the
Arpd process

# Add '-d' to command line
for debug information

 

set -x

 

# Monitor entire network

./arpd -i eth1  192.168.114.201

./arpd -i eth2  192.168.115.201

 

 ==========================================================

#
cat start-honeyd.sh 

#!/bin/sh

#

# Honeyd startup script.

# Marcus Ranum/Lance
Spitzner 3 Jan, 2003

#

# PURPOSE: To start the
Honeyd process

# Add '-d' to command line
for debug information

 

set -x

 

# Launch Honeyd

./honeyd -f honeyd.conf -p
nmap.prints -x xprobe2.conf -a nmap.assoc -0 pf.os -l
/var/log/honeyd/honeyd114.log -s /var/log/honeyd/service.log  -i eth1 192.168.114.201

./honeyd -f honeyd.conf -p
nmap.prints -x xprobe2.conf -a nmap.assoc -0 pf.os -l /var/log/honeyd/honeyd115.log
-s /var/log/honeyd/service.log  -i eth2 192.168.115.201

 

<span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;mso-hansi-font-family:
Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">使用以上这些honeyd_kit配置文件<span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">时需要注意以下几点：

a.       <span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">要先创建相关的日志文件。

b.      <span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">对创建的日志文件赋给nobody<span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">权限

c.       <span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">以上两个start<span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">脚本运行后，会有两个arpd,<span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">两个honeyd<span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">进程在后台运行，可以用ps
<span style="font-family:宋体;mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:
minor-fareast;mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">命令来查看。至于退出好像没有什么命令。我是直接用kill<span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">的。

d.      <span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">如果想开机就运行，哪就把这两个start<span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">脚本放到/etc/rc.local<span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">里就好了。

e.      <span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">最后一点要提到的是，用start-arpd.sh,
start-honeyd.sh<span style="font-family:宋体;mso-ascii-font-family:
Calibri;mso-ascii-theme-font:minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:
minor-fareast;mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">这两个脚本启动arpd,
honeyd<span style="font-family:宋体;mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:
minor-fareast;mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">进程后，192.168.114.201,
192.168.115.201<span style="font-family:宋体;mso-ascii-font-family:
Calibri;mso-ascii-theme-font:minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:
minor-fareast;mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">这两个虚拟出来的机器大概需要半小时到一小时后才能被其它机器侦测到。刚开始我就是有点心急，服务起来后就去测试，怎么也扫描不到这两台机器。还反复在找文档，看配置，是不是有问题。要不是有一次服务起来了，正好别人找我有其它事耽误我了一个多小时，回来一测试居然好了，害我也浪费很多时间。

 

8． <span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">报表的产生

<span style="font-family:宋体;mso-ascii-font-family:
Calibri;mso-ascii-theme-font:minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:
minor-fareast;mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">扫描出来的日志估计可看性太差了。以下是我写的一个小脚本来过滤统计honeyd<span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">产生的日志。主要是根据端口进行分类统计的。

# cat create_honeyd_report.sh


#!/bin/bash

DT=`date +%F-%T`

<a href="mailto:MAILBOX=your_name@your_domain.com" target="_blank" target="_blank">MAILBOX=your_name@your_domain.com</a>

 cd /var/log/honeyd

 echo "==================Begin 445 Port Scan
Report===============================" >> rpfile.txt

echo "" >> rpfile.txt

 cat honeyd114.log | grep 445 | awk '{print
$4,"\t\t" ,$6}' | sort | uniq -c | sort -n -r >> rpfile.txt

echo "" >> rpfile.txt

echo "" >> rpfile.txt

cat honeyd115.log | grep 445 | awk '{print
$4,"\t\t" ,$6}' | sort | uniq -c | sort -n -r >> rpfile.txt

 echo "==================Begin 138 Port Scan
Report===============================" >> rpfile.txt

echo "" >> rpfile.txt

echo honeyd114.log | grep 138 | awk '{print
$4,"\t\t" ,$6}' | sort | uniq -c | sort -n -r >> rpfile.txt

echo "" >> rpfile.txt

echo "" >> rpfile.txt

echo honeyd115.log | grep 138 | awk '{print
$4,"\t\t" ,$6}' | sort | uniq -c | sort -n -r >> rpfile.txt

 

echo "==================Begin 139 Port Scan
Report===============================" >> rpfile.txt

echo "" >> rpfile.txt

echo honeyd114.log | grep 139 | awk '{print
$4,"\t\t" ,$6}' | sort | uniq -c | sort -n -r >> rpfile.txt

echo "" >> rpfile.txt

echo "" >> rpfile.txt

echo honeyd115.log | grep 139 | awk '{print
$4,"\t\t" ,$6}' | sort | uniq -c | sort -n -r >> rpfile.txt

 

echo "==================End
Report===============================" >> rpfile.txt

 

mail -s "honeyd 445 port Scan reprot $DT"  $MAILBOX < rpfile.txt

cp honeyd114.log archive_log/honeyd114_$DT.log

cp honeyd115.log archive_log/honeyd115_$DT.log

echo "" > honeyd114.log

echo "" > honeyd115.log

rm -rf rpfile.txt

 

<span style="font-family:宋体;mso-ascii-font-family:
Calibri;mso-ascii-theme-font:minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:
minor-fareast;mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">产生的报表如下：

==================Begin 445 Port
Scan Report===============================

 

                 16          192.168.118.80
                                 192.168.114.201

                 16          
192.168.118.28                                  192.168.114.201

                15           
192.168.118.41                                  192.168.114.201

                12           
192.168.117.109                                192.168.114.201

                 8             
192.168.118.44                                  192.168.114.201

<span style="font-family:宋体;mso-ascii-font-family:
Calibri;mso-ascii-theme-font:minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:
minor-fareast;mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">其中第一个数字为次数，第二个为源IP<span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">，第三个为目的IP<span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">。也就是源IP<span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">尝试连接目的IP
<span style="font-family:宋体;mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:
minor-fareast;mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">端445<span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">口总共多少次。

  

============================================================================================

 linux<span style="font-family:宋体;mso-ascii-font-family:
Calibri;mso-ascii-theme-font:minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:
minor-fareast;mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">下安装honeyd<span style="font-family:宋体;mso-ascii-font-family:Calibri;mso-ascii-theme-font:
minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">蜜罐系统【原创】

 <span style="font-family:宋体;mso-ascii-font-family:
Calibri;mso-ascii-theme-font:minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:
minor-fareast;mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">标签：<a href="http://blog.51cto.com/tagindex.php?keyword=linux" target="_blank" target="_blank">linux</a>
<a href="http://blog.51cto.com/tagindex.php?keyword=honeyd" target="_blank" target="_blank">honeyd</a>
<a href="http://blog.51cto.com/tagindex.php?keyword=%C3%DB%B9%DE%CF%B5%CD%B3" target="_blank" target="_blank"><span style="font-family:宋体;mso-ascii-font-family:
Calibri;mso-ascii-theme-font:minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:
minor-fareast;mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">蜜罐系统</a>


<span style="font-family:宋体;mso-ascii-font-family:
Calibri;mso-ascii-theme-font:minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:
minor-fareast;mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">原创作品，允许转载，转载时请务必以超链接形式标明文章 <a href="http://297020555.blog.51cto.com/1396304/538183" target="_blank" target="_blank"><span style="font-family:宋体;mso-ascii-font-family:
Calibri;mso-ascii-theme-font:minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:
minor-fareast;mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">原始出处</a>
<span style="font-family:宋体;mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;mso-fareast-font-family:宋体;mso-fareast-theme-font:
minor-fareast;mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin" lang="ZH-CN">、作者信息和本声明。否则将追究法律责任。<a href="http://297020555.blog.51cto.com/1396304/538183" target="_blank" target="_blank">http://297020555.blog.51cto.com/1396304/538183</a>


经过一上午的不懈努力，终于把honeyd给装上了，虽然途中报错无数，但我还是成功了。之所以能成功，还是多亏baidu和google的帮忙，更重要的是那些肯分享技术的人。正所谓取之于网络，回报于网络。所以我也就把我的经验拿出来和大家分享。

一. 安装环境：centos
5.5

需要的软件：

<a href="http://www.honeyd.org/uploads/honeyd-1.5c.tar.gz" target="_blank" target="_blank">honeyd-1.5c.tar.gz</a>

<a href="http://cdnetworks-kr-1.dl.sourceforge.net/project/libdnet/libdnet/libdnet-1.11/libdnet-1.11.tar.gz" target="_blank" target="_blank">libdnet-1.11.tar.gz</a>

<a href="http://www.monkey.org/%7Eprovos/libevent-1.4.14b-stable.tar.gz" target="_blank" target="_blank">libevent-1.4.14b-stable.tar.gz</a>

<a href="http://www.monkey.org/%7Eprovos/libdnsres-0.1a.tar.gz" target="_blank" target="_blank">libdnsres-0.1a.tar.gz</a>

<a href="http://www.tcpdump.org/release/libpcap-1.1.1.tar.gz" target="_blank" target="_blank">libpcap-1.1.1.tar.gz</a>

<a href="http://www.citi.umich.edu/u/provos/honeyd/arpd-0.2.tar.gz" target="_blank" target="_blank">arpd-0.2.tar.gz</a>

<a href="http://www.citi.umich.edu/u/provos/honeyd/honeyd_kit-1.0c-a.tgz" target="_blank" target="_blank">honeyd_kit-1.0c-a.tgz</a>

二. 下载上边的软件包，可以点击下载，也可以到附件中下载。

三. 安装

  tar zxvf honeyd-1.5c.tar.gz

  cd honeyd-1.5c

  ./configure

出错了：configure: error: libpcap not found

原因是没有安装libpcap包，现在开始安装。

tar zxvf libpcap-1.1.1.tar.gz

cd libpcap-1.1.1

./configure ;make;make install

安装完libpcap后再回来安装honeyd。

./configure

又出错了：

checking for dnet-config... no 
configure: error: dnet-config not found

缺少libdnet包。

tar zxvf libdnet-1.11.tar.gz

cd libdnet-1.11

./configure ;make;make install

再回来安装honeyd。

 

./configure 

出错：

checking for libevent... no 
configure: error: libevent not found

缺少libevent包。

 tar zxvf libevent-1.4.14b-stable.tar.gz

 cd libevent-1.4.14b-stable

./configure ;make;make install

 

再回来安装honeyd。

 

./configure 

出错了：configure: error: need either libedit or libreadline;
install one of them

解决办法：

 yum install -y readline readline-devel

再回来安装honeyd。

 

./configure ;make;make install

安装完honeyd后接下来安装arpd包。

tar zxvf arpd-0.2.tar.gz

cd arpd

./configure

make

make的时候出错了：

arpd.c: In function 'arpd_send': 
arpd.c:268: error: expected ')' before string constant 
arpd.c: In function 'arpd_lookup': 
arpd.c:285: error: expected ')' before string constant 
arpd.c:294: error: expected ')' before string constant 
arpd.c:297: error: expected ')' before string constant 
arpd.c: In function 'arpd_recv_cb': 
arpd.c:426: error: expected ')' before string constant 
make: *** Error 1

解决方法：

在arpd/arpd.c文件中添加 #define
__FUNCTION__ ""

然后在编译

make；make install


现在基本上就安装成功了。

四. 
还容易遇到的问题

 arpd包编译成功后，连接生成arpd二进制程序，在linux下运行时，出现如下错误： 
# arpd 
./arpd/arpd: error while loading shared libraries: libevent-1.4.so.2: cannot
open shared object file: No such file or directo

解决方法： 
方法一：直接把libevent-1.4.so.2文件拷贝到系统指定的/usr/lib库文件目录中。或者做符合连接  

方法二：设置/etc/ld.so.conf文件，编辑该文件，在文件中加入libevent-1.4.so.2所在的目录，保存后退出。需要注意的是，每次改动ld.so.conf之后需要运行ldconfing来确认刷新。

 原因分析： 
arpd运行时，需要libevent库的支持，所以在运行arpd前，要先编译好libevent包，并把产生的libevent-1.4.so.2文件拷贝到系统默认的库文件目录下，以便arpd运行时能够连接到。

 

 

五.
Honeyd的简单配置使用

Honeyd 的命令格式如下： 
       honeyd [-dP] [-l logfile] [-s servicelog]
[-p fingerprints] [-0 p0f-file] [-x xprobe] 
                   
[-a assoc] [-f file] [-i interface] [-u uid] [-g gid] 
                   
[--webserver-address address] [--webserver-port port] 
                   
[--webserver-root path] [--rrdtool-path path] 
                   
[--disable-webserver] [--disable-update] [--verify-config] 
                   
[--fix-webserver-permissions] [-V|--version] [-h|--help] [--include-dir] 
                   
[--data-dir] 

各选项的含义如下： 
       -d ：非守护程序的形式，允许冗长的调试信息。

-P ：在一些系统中，pcap 不能通过 select(2)来获得事件通知是不可能的，在这种情况下，honeyd
需要在轮训模式下工作，这个标志位是使论询位有效的。
 
       -l logfile：对日志包和日志文件的连接是被日志文件指定的。

-s servicelog：将honeyd记录的服务层日志写入到指定的服务日志文件中。

-x xprobe：读 xprobe 类型的指纹，这个文件决定了 honeyd 如何响应 ICMP 指纹工具。

-a assoc：读联系 nmap 风格指纹和 xprobe 指纹风格的文件。

-f file：读取名为 file 的配置文件。

-i interface：指定侦听的接口，可以指定多个接口。

[ V|--version：打印出版本信息同时退出。

-include-dir：用作插件开发，指定 honeyd 存贮它的头文件的位置。

[--webserver-address address] [--webserver-port
port] [--webserver-root path] [--rrdtool-path path]
[--fix-webserver-permissions]指定Honeyd软件内建Web服务的地址、端口和根目录，以及Web服务依赖的 RRDTool的位置，--fix-webserver-permissions修正Web目录权限设置导致网页不可读取问题。

net：指定IP地址或者网络或者IP地址范围，如果没有指定，honeyd将监视它能看见的任何IP地址的流量。

 

在Honeyd软件宿主主机上运行arpd绑定同一网段中某个空闲IP地址，然后运行Honeyd软件在此空闲IP地址上构建虚拟蜜罐。 
#arpd 192.168.100.5

#mkdir /var/log/honeyd 
#touch /var/log/honeyd/honeyd.log 
#touch /var/log/honeyd/service.log 
#chown nobody.nobody /var/log/honeyd/*.log 
# ll /var/log/honeyd 
总计 8 
-rw-r--r-- 1 nobody nobody 2617 12-09 17:44 honeyd.log 
-rw-r--r-- 1 nobody nobody  102 12-09 17:44 service.log

 
# honeyd -d -l /var/log/honeyd/honeyd.log -s
/var/log/honeyd/service.log --fix-webserver-permissions 192.168.100.100 
Honeyd V1.5c Copyright (c) 2002-2007 Niels Provos 
honeyd: started with -d -l /var/log/honeyd/honeyd.log -s
/var/log/honeyd/service.log --fix-webserver-permissions 192.168.100.100 
Warning: Impossible SI range in Class fingerprint "IBM OS/400 V4R2M0" 
Warning: Impossible SI range in Class fingerprint "Microsoft Windows NT
4.0 SP3" 
honeyd: listening promiscuously on eth0: (arp or ip proto 47 or (udp and
src port 67 and dst port 68) or (ip and (host 192.168.100.100))) and not ether
src 00:0c:29:51:b7:f3 
honeyd: Demoting process privileges to uid 99, gid 99 
honeyd: update_check: failed to resolve host. 
honeyd: Sending ICMP Echo Reply: 192.168.100.100 -> 192.168.100.1 
honeyd: Sending ICMP Echo Reply: 192.168.100.100 -> 192.168.100.1 
honeyd: Sending ICMP Echo Reply: 192.168.100.100 -> 192.168.100.1 
honeyd: Sending ICMP Echo Reply: 192.168.100.100 -> 192.168.100.1

 如果上面的内容还不能解决您的问题，可以与我qq联系。qq：297020555

 

出错：configure:
error: libdnsres not found

解决办法：

wget <a href="http://www.monkey.org/%7Eprovos/libdnsres-0.1a.tar.gz" target="_blank" target="_blank">http://www.monkey.org/~provos/libdnsres-0.1a.tar.gz </a>

tar zxvf libdnsres-0.1a.tar.gz

cd libdnsres-0.1a

./configure ;make;make install

错误：

yacc -d ./parse.y 
make: yacc: Command not found 
make: *** Error 127

解决办法：

yum install -y byacc

编译libpcap时出错：

configure: error: Your operating system's lex is insufficient to compile 
 libpcap.  flex is a lex replacement that has many advantages,
including 
 being able to compile libpcap.  For more information, see 
 <a href="http://www.gnu.org/software/flex/flex.html" target="_blank" target="_blank">http://www.gnu.org/software/flex/flex.html</a> .

问题：

缺少flex包

解决办法：

yum install -y flex

出错：

make all-recursive 
make: Entering directory `/home/jlawre23/Desktop/honeyd-1.5c' 
Making all in . 
make: Entering directory `/home/jlawre23/Desktop/honeyd-1.5c' 
gcc -DHAVE_CONFIG_H -I. -I. -I. -I./compat/libdnet -I./compat -I/usr/local/include
-I/usr/include/pcap -I/usr/include -O2 -Wall -g
-DPATH_HONEYDINCLUDE="\"/usr/local/include/honeyd\""
-DPATH_HONEYDDATA="\"/usr/local/share/honeyd\""
-DPATH_HONEYDLIB="\"/usr/local/lib/honeyd\""
-DHONEYD_PLUGINS_DECLARE="" -DHONEYD_PLUGINS=""
-DPATH_RRDTOOL="\"\"" -c honeyd.c 
In file included from honeyd.c:97: 
tagging.h:89: error: expected declaration specifiers or ‘...’ before ‘(’ token 
tagging.h:89: error: expected declaration specifiers or ‘...’ before ‘(’ token 
In file included from stats.h:36, 
from honeyd.c:98: 
./compat/sha1.h:23: warning: ‘__bounded__’ attribute directive ignored 
./compat/sha1.h:23: warning: ‘__bounded__’ attribute directive ignored 
./compat/sha1.h:26: warning: ‘__bounded__’ attribute directive ignored 
./compat/sha1.h:28: warning: ‘__bounded__’ attribute directive ignored 
./compat/sha1.h:30: warning: ‘__bounded__’ attribute directive ignored 
./compat/sha1.h:32: warning: ‘__bounded__’ attribute directive ignored 
./compat/sha1.h:35: warning: ‘__bounded__’ attribute directive ignored 
./compat/sha1.h:35: warning: ‘__bounded__’ attribute directive ignored 
make: *** Error 1 
make: Leaving directory `/home/jlawre23/Desktop/honeyd-1.5c' 
make: *** Error 1 
make: Leaving directory `/home/jlawre23/Desktop/honeyd-1.5c' 
make: *** Error 2

解决办法：

卸掉其他版本的libevent包，安装本文提供的libevent-1.4.14b-stable。

 

<div style="mso-element:para-border-div;border:none;border-bottom:double windowtext 2.25pt;
padding:0in 0in 1.0pt 0in">

本文出自 “<a href="http://297020555.blog.51cto.com/" target="_blank" target="_blank">netcat</a>” 博客，请务必保留此出处<a href="http://297020555.blog.51cto.com/1396304/538183" target="_blank" target="_blank">http://297020555.blog.51cto.com/1396304/538183</a>

</div>

jiayou_lm 发表于 2015-10-30 10:43

你好，请教下，如果只有一个网口eth0，那么start-arp.sh,和start-honeyd.sh中的
# Monitor entire network
./arpd -i eth1192.168.114.201
./arpd -i eth2192.168.115.201

./honeyd -f honeyd.conf -p nmap.prints -x xprobe2.conf -a nmap.assoc -0 pf.os -l /var/log/honeyd/honeyd114.log -s /var/log/honeyd/service.log-i eth1 192.168.114.201

./honeyd -f honeyd.conf -p nmap.prints -x xprobe2.conf -a nmap.assoc -0 pf.os -l /var/log/honeyd/honeyd115.log -s /var/log/honeyd/service.log-i eth2 192.168.115.201
该如何写？

页: [1]

Chinaunix's Archiver

honeyd的安装与使用