Uncertainities about router configuration in honeyd

[Markus Schabel <markus.schabel () tgm ac at>]

If I create the following configuration and do some traceroutes to find 
out the layout of the network I'm not sure whether I got all things 
correct or not...

> route entry 192.168.0.1
> route 192.168.0.1 link 192.168.0.0/24
>
> create default
> set default default tcp action block
> set default default udp action block
> set default default icmp action block
>
> create router
> set router personality "Cisco 3600 router running IOS 12.2(6c)"
>
> create solaris
> set solaris personality "Sun Solaris 2.6"
>
> bind router 192.168.0.1
> bind solaris 192.168.0.2

What does the phrase "entry point" exactly means? Is it like the
following scheme:


    +---+                                           +---+
    |   |                                           |   |
    +---+                                           +---+
   +-----+                                         +-----+
   +-----+                                         +-----+
      | .?   ?.?.?.?   .? (-) .1  192.168.0.0/24   .3 |
    --+------------------( X )------------------------+
       [which network?]   (-)
(me@localhost,       (entry point,
loopback int)           router)
[which IP?]           [which IP?]

Is it correct that the 192.168.0.0 network is behind the router? Which
network is in front of the router (especially if I use the loopback
interface)?

If I change the configuration to the following:

> route entry 192.168.0.1
> route 192.168.0.1 link 192.168.0.0/24
> route 192.168.0.1 link 192.168.1.0/24
> [..]

I get the following:

    +---+                                           +---+
    |   |                                           |   |
    +---+                                           +---+
   +-----+                                         +-----+
   +-----+                        192.168.1.0/24   +-----+
      | .?   ?.?.?.?   .? (-) .1  192.168.0.0/24   .3 |
    --+------------------( X )------------------------+
                          (-)

Is it possible to configure honeyd to simulate the following (an
additional network attached to the router):

    +---+                    192.168.1.0/24         +---+
    |   |                  +------------------      |   |
    +---+                  |                        +---+
   +-----+                 |                       +-----+
   +-----+                 |                       +-----+
      | .?   ?.?.?.?   .? (-) .1  192.168.0.0/24   .3 |
    --+------------------( X )------------------------+
                          (-)

If I add other routers to the network like the following:

> route entry 192.168.0.1
> route 192.168.0.1 link 192.168.0.0/24
> route 192.168.0.1 add net 192.168.2.0/24 192.168.2.1
> route 192.168.2.1 link 192.168.2.0/24
> [..]
> bind router 192.168.0.1
> bind router 192.168.2.1

I get the following:


    +---+
    |   |
    +---+
   +-----+
   +-----+
      |       (-) .1            .? (-) .1
    --+------( X )----------------( X )----------------
              (-)  192.168.0.0/24  (-)  192.168.2.0/24

What is the first (left) IP address of the second router? Is that router
connected over the 192.168.0.0 network or directly attached to the first
one?

If I go further and add another router here:

> route entry 192.168.0.1
> route 192.168.0.1 link 192.168.0.0/24
> route 192.168.0.1 add net 192.168.2.0/24 192.168.2.1
> route 192.168.0.1 add net 192.168.4.0/24 192.168.4.1
> route 192.168.2.1 link 192.168.2.0/24
> route 192.168.4.1 link 192.168.4.0/24
> [..]
> bind router 192.168.0.1
> bind router 192.168.2.1
> bind router 192.168.4.1

I get the following:

    +---+                    .? (-) .1
    |   |                 +----( X )-------------------
    +---+                 |     (-)  192.168.4.0/24
   +-----+                |
   +-----+                |
      |       (-) .1      |     .? (-) .1
    --+------( X )--------+-------( X )----------------
              (-)  192.168.0.0/24  (-)  192.168.2.0/24

But shouldn't look it like the following:

    +---+                    .? (-) .1
    |   |      +---------------( X )-------------------
    +---+      |                (-)  192.168.4.0/24
   +-----+     |
   +-----+     |
      |       (-) .1
    --+------( X )-------------------------------------
              (-)                    192.168.0.0/24
               |
               |
               |             .? (-) .1
               +---------------( X )-------------------
                                (-)  192.168.2.0/24

Hopefully somebody can get some light into all this stuff...

Is there anywhere a _good_ howto about this topic?

thanks & best regards
Markus
--
          \\\ ||| ///                               _\=/_
           (  @ @  )                                (o o)
+--------oOOo-(_)-oOOo--------------------------oOOo-(_)-oOOo------+
| Markus Schabel      TGM - Die Schule der Technik   www.tgm.ac.at |
| IT-Service          A-1200 Wien, Wexstrasse 19-23  net.tgm.ac.at |
| markus.schabel () tgm ac at                   Tel.: +43(1)33126/316 |
| markus.schabel () members fsf org             Fax.: +43(1)33126/154 |
| FSF Associate Member #597, Linux User #259595 (counter.li.org)   |
|        oOOo        Yet Another Spam Trap:     oOOo               |
|       (    )    oOOo    yast () tgm ac at       (   )     oOOo      |
+--------\  (----(   )--------------------------\ ( -----(   )-----+
          \_)     ) /                            \_)      ) /
                 (_/                                     (_/

Computers are like airconditioners:
  They stop working properly if you open windows.