1

I am creating a virtual environment where I have created three virtual machines,

  • CentOS as an Apache Webserver
  • CentOs as an Attacker machine
  • FreeBSD with Honeyd to setup Honeypot

I have connected all three virtual machines in a same network, and installed honeyd in Attacker machine.

The IP of attacker is 192.168.154.100
The IP of machine where honeyd is installed is 192.168.154.28
The IP of honeypot that is created by honeyd is 192.168.154.22
The IP of my Apache Webserver is 192.168.154.21

Using Attacker machine I perform an nmap scan using the following command,

nmap 192.168.154.*

and honeyd successfully detected the attack.

But I have one problem, honeyd is installed in separate machine as Apache webserver. How can I block TCP scans from the attacker IP address to my webserver?

I installed a firewall in my Apache webserver virtual machine but how does my Apache machine know which IP are performing attacks so that I can block them?

  • 2
    I am very confused about your question. What does honeyd have to do with blocking IPs to your web server? Were you hoping to use honeyd as an IPS? – schroeder Oct 25 '15 at 4:54
  • 1
    yes as an IDS, because that's what we are told to use. I need to block tcp scans to my apache web server which is in the same network as honeyd – Riley Willow Oct 25 '15 at 4:56
  • You were told to use honeyd as an IPS and not snort (an actual IPS)? This question, then, is not an InfoSec question, per se, but rather a scripting question: "how to I export the IPs detected from honeyd to another machine". – schroeder Oct 25 '15 at 15:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.