PLEASE NOTE:
If you installed 2.4b3, rpm will complain when you try to
upgrade to 2.4; it gets confused by the "b3" part of the version name.
Add "--oldpackage" to the command line and 2.4 will go in just fine.
The network autodetection is NOT working in the 2.1-0 releases
and below. You must hardcode the network and netmask you wish to use
in /etc/labrea.conf. For example, if your network is 192.168.1.0 and
your netmask is 255.255.255.0, change the line in /etc/labrea.conf that
reads:
LABREAOPTIONS="-s -l -p 32000"
to:
LABREAOPTIONS="-s -l -p 32000 -m 255.255.255.0 -n 192.168.1.0"
and add any other options you'd like.
Hardcoding the network and netmask IS NOT neccesary for labrea
2.2 and above - which you should be using anyways.
If you wish to recompile this, make sure you are NOT using
redhat's libpcap rpm. Instead, get the libpcap from tcpdump.org and
compile and install it, THEN recompile the labrea rpm. If you use
redhat's libpcap, the resulting labrea binary will not be able to detect
network settings, as described above.
- William Stearns <[email protected]>
Name : labrea Relocations: (not relocatable) Version : 2.4 Vendor: Tom Liston <[email protected]> Release : 1 Build Date: Wed Feb 19 12:04:08 2003 Install Date: (not installed) Build Host: sparrow Group : System Environment/Daemons Source RPM: labrea-2.4-1.src.rpm Size : 152690 License: GPL Signature : RSA/MD5, Wed Feb 19 12:04:09 2003, Key ID 012334cbf322929d Packager : William Stearns <[email protected]> URL : http://www.hackbusters.net/LaBrea/ Summary : labrea is a daemon to create a tarpit or sticky honeypot Description : LaBrea is a program that creates a tarpit or, as some have called it, a "sticky honeypot". LaBrea takes over unused IP addresses on a network and creates "virtual machines" that answer to connection attempts. LaBrea answers those connection attempts in a way that causes the machine at the other end to get "stuck", sometimes for a very long time.
The files in this collection are part of William Stearns' software archive. If any of the links on this page do not work, you may be viewing an incomplete mirror. There is a complete list of the mirror sites at the starting page for this mirror and at the primary mirror.