Honeypots: Re: openBSD: bad pcap filter

[chakl () syscall de (Olaf Schreck)]

Josh,

> I would like to have honeyd listen to the loopback interface
> (lo0).  When I try to launch honeyd on this interface I get an error as
> shown in the output below. 
> honeyd: unsupported datalink type
> honeyd[12299]: listening on lo0: ip
> honeyd: bad pcap filter: unknown data link type 12
This error comes from the pcap library, not from honeyd itself. 
Honeyd uses this library to pull packet from the interfaces.  
Pcap says it does not understand data link type 12 (DLT_LOOP). 

What version of OpenBSD are you running?  Did you compile libpcap 
from source instead of using the one that comes with the system? 
A quick check with OpenBSD 3.2 and 3.5 shows that type 12 / DLT_LOOP 
should be recognized by the system libpcap.  Another check on Linux 
(which uses LBNL's libpcap) shows that type 12 being DLT_RAW there, 
so it seems there are significant differences in the that part of the 
libpcap code.  Anyway, this error should not show up in native OpenBSD.


I don't really understand the reasoning to put honeyd on the loopback 
interface.  Loopback interfaces are somewhat special in OpenBSD, you 
should not do what you're trying to achieve unless you can deal with 
the errors yourself.


ciao,
chakl
-- 
Olaf Schreck    chakl () syscall de        syscall() Network Solutions, Berlin