From: "Jeffrey B. Murphy" <jbmurphy@gmail.com>
To: netfilter@lists.netfilter.org
Subject: iptables and arpd
Date: Thu, 31 Mar 2005 14:04:36 -0500 [thread overview]
Message-ID: <89629fe005033111041b245b9d@mail.gmail.com> (raw)
I sent this to the honeypots list but I got no takers. I was hoping
someone here might be able to help me. My question involves the
interaction between iptables and arpd. arpd is used in the honeyd
project (http://www.honeyd.org/tools.php).
I have a fedora core 3 box and I have the following iptables script:
# IptablesScript
iptables -F
iptables -X
# Set Default Policy to drop everything
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
I believe that this should block all traffic going to and from the
machine (Ip address of 192.168.0.3)
So I ping 192.168.0.3 and get no response back (As I expected)
When I add arpd into the mix with honeyd bound to the arpd ip (192.168.0.5)
I ping the arpd/honeyd IP of 192.168.0.5 from a different machine and
I get no response back (as I expected)
BUT my honeyd sees the traffic:
honeyd[PID]: Sending ICMP Echo Reply: IPAddyOfHoneyPot -> SourceMachine
honeyd[PID]: couldn't send packet: Operation not permitted
So I don't understand why the traffic is getting to the arpd/honeyd
process if my iptables is dropping everything?
I understand why I am getting the "honeyd[PID]: couldn't send packet:
Operation not permitted" as the default OUTPUT chain is drop. But why
is the traffic getting by my INPUT chain?
I realize that arpd and honeyd are not applicable to the list, but I
received no replies (I guess I am out of karma) on the honeyd list or
from the maintainer of the arpd project.
Any help is appreciated.
And Thanks.
reply other threads:[~2005-03-31 19:04 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=89629fe005033111041b245b9d@mail.gmail.com \
--to=jbmurphy@gmail.com \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.