I've got the Honeyd honeypot in one virtual machine (kali) and nmap in another (ubuntu), the config file looks like this:
create default set default default tcp action closed set default default udp action closed set default default icmp action open create windows set windows personality "Microsoft Windows XP Professional SP1" set windows default tcp action open set windows default udp action open set windows default icmp action closed add windows tcp port 21 "sh scripts/unix/linux/ftp.sh" add windows tcp port 135 open add windows tcp port 139 open add windows tcp port 445 open set windows ethernet "00:0c:38:8d:8c:17" dhcp windows on eth0
... Then i'm running honey as
sudo honeyd -f <my config file> -l <my log> -p nmap-os-db -a nmap.assoc -0 pf.os -x xprobe2.conf -d
When i perform scans i get some results:
I get some UDP and ARP detection but no SYN scan detection or anything else.
The scans I'm doing are quite aggressive ones too:
nmap <ip> -sT -A -O
Yet it picks up nothing? - and the OS is not detected properly.
Can anyone spot my mistake? - The OS detection is not working its saying there are too many results and all 1000 scanned ports are coming back as filtered.