labrea-users — Labrea user interaction / discussion

[Labrea-users] hard capture

[Mark <md...@wi...>]

Hello,
What is a "hard capture" as defined in the -h ?
and why use it ?

Thanks
mark 

 
______________ ______________ ______________ ______________
Sent via the WirelessCommunityNetworks WebMail system at wirelesscommunitynetworks.com


 
                   

Re: [Labrea-users] Re: Configuration problem - tarpitting machine on local subnet

[Ed T. <ed....@et...>]

I think I finally figured out what was going on.  I had put an Exclude
on the IPs that had live machines on them, but forgot to put a HAR on
them, as well.  It seems that one of the live IPs was being grabbed by
LaBrea, and it happened to be the IP of the box which contains, among
other things, my Samba server and my Squid proxy.  So, when the Windows
box tried to access either one of them...

Anyway, I updated the config file, then killed LaBrea long enough to
clear that IP up, and since I restarted it I haven't seen that IP pop
back up.

Thanks for the assist.

-- 
Cheers,
Ed Truitt
PGP fingerprint:  5368 D25E 468C A250 9833  CCD6 DBAE 9C25 02F9 0AB9
http://www.etee2k.net
http://www.bsatroop148.org

"Note to spammers:  my 'delete' key is connected to YOUR ISP.
 Also, if you send me UCE, I reserve the right to post your spew
on my Web site, with the appropriate color commentary, so that
others may have a good laugh at your expense."

[Labrea-users] Re: Configuration problem - tarpitting machine on local subnet

[Mike B. <bro...@ho...>]

Ed:

I run 2.5-Stable-1 on a couple machines on completely different networks 
(was that you I've seen pulling stats from one of them with Michael's 
script? ;D ). One is running Fedora Core 1 and the other is RH 9.0 and I 
haven't seen the problem of tarpitting local machines.  That being said, I 
should also say that there are no Windows machines on those subnets.

I certainly do exclude addresses though and have never had the tarpit step 
out-of-bounds and overtake occupied addresses.  I put EXC lines in 
/usr/local/etc/labrea.conf and it works fine.  I didn't see anything in the 
documentation that explicilty said you could put more than one EXC or IPI 
line in the .conf but I did it and it appears to work.

You said you did an IPI but have you tried a POR to block those ports?  Not 
that this would be an ultimate solution but it would be another data point.  
At a guess, I would say if IPI and POR don't work for your 139/445/local 
hosts problem and EXC doesn't work for your overtake problem, Labrea is not 
reading the config file.  Could you have some conflicts from your old 
install?  Looking at a different config file?

What does it say when you start it manually (non-daemon mode)?  It should 
dump out some results as it parses the .conf file.

_________________________________________________________________
Don’t just search. Find. Check out the new MSN Search! 
http://search.msn.click-url.com/go/onm00200636ave/direct/01/

[Labrea-users] Configuration problem - tarpitting machine on local subnet

[Ed T. <ed....@et...>]

I am having a problem with the latest version of LaBrea (2.5-stable-1, 
compiled from source and running on a SuSE 9.0 system).  I am tarpitting 
a local WinXP box (a legit, un0\/\/n3d box on my subnet) on ports 139 
and 445.  I have tried IPIGNORE and IPI on both the address and the 
block, but it still gets pitted.  I am also noticing that IPs I have 
configured as "exclude" are being captured (and some of them have real 
machines on them!)  Is anyone else having these problems, and if so how 
did you get around them?

BTW, when I was running 2.4b3, I never had these problems.

-- 
Cheers,
Ed Truitt
PGP fingerprint:  5368 D25E 468C A250 9833  CCD6 DBAE 9C25 02F9 0AB9
http://www.etee2k.net
http://www.bsatroop148.org

"Note to spammers:  my 'delete' key is connected to YOUR ISP.
 Also, if you send me UCE, I reserve the right to post your spew
on my Web site, with the appropriate color commentary, so that
others may have a good laugh at your expense."

[Labrea-users] Multiple versions/instances of Labrea

[Pierce, R. <rdp...@pr...>]

Loren,
=20
I'm wondering how one can run multiple copies of Labrea on the same
network.
=20
Ideally, to tarpit worms the quickest, you'd have a tarpit on every
subnet since worms typically start out by portscanning their local
subnet and moving outwards from there.  However, since Labrea uses the
same MAC address for all captured hosts, you'd end up with the same MAC
out different interfaces of your switches and conflicting entries in
your FDB's.
=20
I know Labrea can be configured to use various interfaces on a box, can
it be configured to return a different MAC address rather than the
0:0:f:ff:ff:ff one?
=20
Thanks,
=20
Bob Pierce

[Labrea-users] TR: Labrea Question

[Gordon, L. <Lor...@te...>]

-----Message d'origine-----
De : lorgor
Envoy=E9 : 27 juillet, 2004 17:12
=C0 : 'Mike'
Objet : RE: Labrea Question


Sorry to be so long in responding. You don't specify but if we're =
talking
iptables, i imagine it's linux.

labrea needs to see a packet coming in the mac address of one of the =
virtual
IP machines. Just redirecting the packet via iptables won't do it =
(IMHO)
because you will have the mac of the real machine. labrea ignores these
packets.

lorgor

-----Message d'origine-----
De : Mike
Envoy=E9 : 27 juillet, 2004 11:30
=C0 : lo...@us...
Objet : Labrea Question


Lorgor:
  I posted this to the mailing list but haven't heard anything.  Don't =
know=20
if you monitor that or not.  All addresses are (obviously) notional.


=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

I must be missing something, but everything I've tried seems to =
indicate=20
that this is not possible - redirecting traffic to a tarpit running on =
the=20
same machine.

Say I have a machine running at 10.10.10.1 with normal mail and web=20
services.  I also have Labrea running on the SAME machine, capturing=20
10.10.10..2 through 10.10.10.10.

Someone with the IP address 192.168.50.50 starts attacking my website =
at=20
10.10.10.1.  I would like to have a script detect the attack and issue =
the=20
iptables command to redirect this address to the tarpit addresses.  =
Ideally=20
I would have access to the upstream router to do this redirect before =
it=20
even hits the web/tarpit box, but I don't.

I assumed I could simply do this by NATing the destination address from =

10.10.10.1 to 10.10.10.2 but it doesn't seem to work.

Would this iptables entry go in the INPUT chain or the FORWARD chain?  =
Is it

even possible?

/sbin/iptables -t nat -I PREROUTING -s 192.168.50.50 -p tcp -j DNAT=20
--to-destination 10.10.10.2
/sbin/iptables -I INPUT -s 192.168.50.50 -p tcp -j ACCEPT

Yes, I know the new version of iptables has a -j TARPIT option, but I =
don't=20
have that kernel built.

Thanks.
Mike

[Labrea-users] Redirecting locally to the tarpit

[Mike B. <bro...@ho...>]

I must be missing something, but everything I’ve tried seems to indicate 
that this is not possible – redirecting traffic to a tarpit running on the 
same machine.

Say I have a machine running at 10.10.10.1 with normal mail and web 
services.  I also have Labrea running on the SAME machine, capturing 
10.10.10.2 through 10.10.10.10.

Someone with the IP address 192.168.50.50 starts attacking my website at 
10.10.10.1.  I would like to have a script detect the attack and issue the 
iptables command to redirect this address to the tarpit addresses.  Ideally 
I would have access to the upstream router to do this redirect before it 
even hits the web/tarpit box, but I don’t.

I assumed I could simply do this by NATing the destination address from 
10.10.10.1 to 10.10.10.2 but it doesn’t seem to work.

Would this iptables entry go in the INPUT chain or the FORWARD chain?  Is it 
even possible?

/sbin/iptables -t nat -I PREROUTING -s 192.168.50.50 -p tcp -j DNAT 
--to-destination 10.10.10.2
/sbin/iptables -I INPUT -s 192.168.50.50 -p tcp -j ACCEPT

Yes, I know the new version of iptables has a –j TARPIT option, but I don’t 
have that kernel built.

Thanks.
Mike

_________________________________________________________________
Don’t just search. Find. Check out the new MSN Search! 
http://search.msn.click-url.com/go/onm00200636ave/direct/01/

[Labrea-users] Configuring and starting Labrea

[Praveen M. <pra...@gm...>]

Hi All,

I am newly joined to this group and trying to configure/make setup to
run Labrea. Its was really hard time, because of too many options. In
the config file

192.168.200.1-192.168.200.240 EXC
192.168.200.20 HAR
192.168.200.48/29 IPI
27-333 POR

These were the default parameters i have selected. Now on my machine I
am running Labrea(192.168.200.1)
./labrea -o <BPF FILTER> ---- what is this?

Can someone help me in setting this up?

Thanks,

-Praveen


-- 

Praveen Morab
Storability Software
Email: pra...@st...
Tel: (M) 98500 56463
       (R) 2543 13 65

Re: [Labrea-users] Question about the log

[Paul W. <pw...@nc...>]

My understanding is that the "*" is there to simply prevent syslog from  
putting "Above message repeated x number of times" in the log for  
duplicate entries.
Not sure how you know if a connection has been dropped other than it no  
longer has log messages showing up.

-paul

On Jul 8, 2004, at 7:29 PM, chuck wrote:

> labrea -z -i eth1 -v -h -o > /var/log/LaBrea.log
>    gives ....
> Thu Jul  8 17:59:50 2004  Initial Connect - tarpitting: 81.84.126.252  
> 3716 -> 67.41.73.202 445 *
> Thu Jul  8 18:01:39 2004  Initial Connect - tarpitting:  
> 218.190.198.124 3927 -> 67.41.73.202 5554
> Thu Jul  8 18:01:39 2004  Initial Connect - tarpitting:  
> 218.190.198.124 3929 -> 67.41.73.204 5554 *
> Thu Jul  8 18:01:39 2004  Initial Connect - tarpitting:  
> 218.190.198.124 3928 -> 67.41.73.203 5554
> Thu Jul  8 18:01:39 2004  Initial Connect - tarpitting:  
> 218.190.198.124 3933 -> 67.41.73.205 5554 *
> Thu Jul  8 18:01:39 2004  Initial Connect - tarpitting:  
> 218.190.198.124 4436 -> 67.41.73.205 5554
> Thu Jul  8 18:01:39 2004  Initial Connect - tarpitting:  
> 218.190.198.124 4435 -> 67.41.73.204 5554 *
> Thu Jul  8 18:01:39 2004  Initial Connect - tarpitting:  
> 218.190.198.124 4434 -> 67.41.73.203 5554
> Thu Jul  8 18:01:39 2004  Initial Connect - tarpitting:  
> 218.190.198.124 4432 -> 67.41.73.202 5554 *
>
> What does the "*" mean?  I can't find a description of the log  
> anywhere.  And how do I
> tell when one has escaped?
> Tks
>
>
>
>
> -------------------------------------------------------
> This SF.Net email sponsored by Black Hat Briefings & Training.
> Attend Black Hat Briefings & Training, Las Vegas July 24-29 - digital  
> self defense, top technical experts, no vendor pitches, unmatched  
> networking opportunities. Visit www.blackhat.com
> _______________________________________________
> Labrea-users mailing list
> Lab...@li...
> https://lists.sourceforge.net/lists/listinfo/labrea-users
>

------------------------------------------------------------------------ 
--------------------
Paul Wefel            NCSA                 Network Engineer
phone: 217-244-2193   cell: 217-840-9929   pw...@nc...
CAB 269, 605 E Springfield, Champaign IL 61820

[Labrea-users] Question about the log

[chuck <ch...@bl...>]

labrea -z -i eth1 -v -h -o > /var/log/LaBrea.log
    gives ....
Thu Jul  8 17:59:50 2004  Initial Connect - tarpitting: 81.84.126.252 
3716 -> 67.41.73.202 445 *
Thu Jul  8 18:01:39 2004  Initial Connect - tarpitting: 218.190.198.124 
3927 -> 67.41.73.202 5554
Thu Jul  8 18:01:39 2004  Initial Connect - tarpitting: 218.190.198.124 
3929 -> 67.41.73.204 5554 *
Thu Jul  8 18:01:39 2004  Initial Connect - tarpitting: 218.190.198.124 
3928 -> 67.41.73.203 5554
Thu Jul  8 18:01:39 2004  Initial Connect - tarpitting: 218.190.198.124 
3933 -> 67.41.73.205 5554 *
Thu Jul  8 18:01:39 2004  Initial Connect - tarpitting: 218.190.198.124 
4436 -> 67.41.73.205 5554
Thu Jul  8 18:01:39 2004  Initial Connect - tarpitting: 218.190.198.124 
4435 -> 67.41.73.204 5554 *
Thu Jul  8 18:01:39 2004  Initial Connect - tarpitting: 218.190.198.124 
4434 -> 67.41.73.203 5554
Thu Jul  8 18:01:39 2004  Initial Connect - tarpitting: 218.190.198.124 
4432 -> 67.41.73.202 5554 *

What does the "*" mean?  I can't find a description of the log 
anywhere.  And how do I
tell when one has escaped? 

Tks

[Labrea-users] No syslog

[Ellis M G. <emg...@nc...>]

I am running FreeBSD 4.10 with Labrea 2.5-stable-1 installed. I am not
getting any logging sent to syslog. If I direct output to stdout I can see
that the Tarpit is working. Anyone have any ideas on what is wrong? Was this
an issue with 2.4?

Thanks for any help or ideas!

E

[Labrea-users] FASD project: Online survey launched

[<ben...@id...>]

Dear Open Source developer

I am doing a research project on "Fun and Software Development" in which I kindly invite you to participate.
You will find the online survey under http://fasd.ethz.ch/qsf/. The questionnaire consists of 53 questions and you will need about 15 minutes to complete it.

With the FASD project (Fun and Software Development) we want to define the motivational significance of fun when software developers decide to engage in Open Source projects. What is special about our research project is that a similar survey is planned with software developers in commercial firms. This procedure allows the immediate comparison between the involved individuals and the conditions of production of these two development models. Thus we hope to obtain substantial new insights to the phenomenon of Open Source Development.


With many thanks for your participation,
Benno Luthiger


PS:
The results of the survey will be published under http://www.isu.unizh.ch/fuehrung/blprojects/FASD/.
We have set up the mailing list fa...@we... for this study. Please see http://fasd.ethz.ch/qsf/mailinglist_en.html for registration to this mailing list.

_______________________________________________________________________

Benno Luthiger
Swiss Federal Institute of Technology Zurich
8092 Zurich

Mail: benno.luthiger(at)id.ethz.ch
_______________________________________________________________________

[Labrea-users] Using labrea outside a firewall infront of a class B network.

[Royston B. <Bo...@li...>]

Hi,
We are in the unenviable position of having a Class B network at the
end of a 1Mb/s frame circuit.
I would like to use labrea infront of my firewall. I've been testing
honeyd, and it can only respond to traffic that is ARPd for on the small
(/24) network in front of the firewall. I guess this is the same for
labrea. So I wondered what other people did? Our firewall is a netscreen
appliance, and I would rather not route the scanning traffic through the
firewall just to tarpit it as then I'll probably run out of sessions
rather than bandwidth.
 
I had hoped there might be something I could do with labrea, in a
promiscous mode to hijack traffic destined for the firewall and
tarpitting the connection, or failing that perhaps using snort with some
kind of sticking flex response, but I didn't find one. 
 
Anyone got any ideas? 
  
Regards
 
Royston

TR: [Labrea-users] Can't start Labrea on an interface with no IP Address assigned (using -n and -m!)

[Gordon, L. <Lor...@te...>]

-----Message d'origine-----
De : lorgor
Envoy=E9 : 21 avril, 2004 17:25
=C0 : 'Eric'
Objet : RE: [Labrea-users] Can't start Labrea on an interface with no =
IP
Address assigned (using -n and -m!)


Looking at the code in lbio_init, around line 300, it seems likely that =
the
interface is not being recognized as being IP for whatever reason.

How is the interface defined? If you can give me some more info, then i =
can
try to reproduce the problem.

Could try without snort but i doubt this will change much.

Maybe a workaround would be to give some dummy ip address to this =
interface.

thanks,

lorgor


-----Message d'origine-----
De : Eric
Envoy=E9 : 21 avril, 2004 13:03
=C0 : lab...@li...
Objet : [Labrea-users] Can't start Labrea on an interface with no IP
Address assigned (using -n and -m!)


We have an interface with no IP address in promisc mode. Snort is also
listening on this interface, could that cause problems?


awweb:/usr/local/sbin # uname -a
Linux awweb 2.4.21-99-default #1 Wed Sep 24 13:30:51 UTC 2003 i686 i686
i386 GNU/Linux

OS: SuSE Linux 9

awweb:/usr/local/sbin # /usr/local/sbin/labrea -i eth1 -n 216.113.234.0
-m 255.255.255.0 -z

Wed Apr 21 09:02:18 2004  User specified capture subnet / mask:
216.113.234.0/24
Wed Apr 21 09:02:18 2004  LaBrea will attempt to capture unused IPs.
Wed Apr 21 09:02:18 2004  Full internal BPF filter: arp or (ip and =
ether
dst host 00:00:0F:FF:FF:FF)
Wed Apr 21 09:02:18 2004  LaBrea will log to syslog
Wed Apr 21 09:02:18 2004  Logging will be verbose.
Wed Apr 21 09:02:18 2004  Initiated on interface: eth1
labrea: *** Unable to determine IP address from the interface.
Wed Apr 21 09:02:18 2004  Labrea exiting...
Wed Apr 21 09:02:18 2004  0/0 packets (received/dropped) by filter




BRDS,

Eric

[Labrea-users] Can't start Labrea on an interface with no IP Address assigned (using -n and -m!)

[Eric H. <eri...@ap...>]

We have an interface with no IP address in promisc mode. Snort is also
listening on this interface, could that cause problems?


awweb:/usr/local/sbin # uname -a
Linux awweb 2.4.21-99-default #1 Wed Sep 24 13:30:51 UTC 2003 i686 i686
i386 GNU/Linux

OS: SuSE Linux 9

awweb:/usr/local/sbin # /usr/local/sbin/labrea -i eth1 -n 216.113.234.0
-m 255.255.255.0 -z

Wed Apr 21 09:02:18 2004  User specified capture subnet / mask:
216.113.234.0/24
Wed Apr 21 09:02:18 2004  LaBrea will attempt to capture unused IPs.
Wed Apr 21 09:02:18 2004  Full internal BPF filter: arp or (ip and ether
dst host 00:00:0F:FF:FF:FF)
Wed Apr 21 09:02:18 2004  LaBrea will log to syslog
Wed Apr 21 09:02:18 2004  Logging will be verbose.
Wed Apr 21 09:02:18 2004  Initiated on interface: eth1
labrea: *** Unable to determine IP address from the interface.
Wed Apr 21 09:02:18 2004  Labrea exiting...
Wed Apr 21 09:02:18 2004  0/0 packets (received/dropped) by filter




BRDS,

Eric Hines, GCIA
CEO, President, Chairman
Applied Watch Technologies, Inc.
http://www.appliedwatch.com
Direct: (877) 262-7593 x327
Fax: (877) 262-7593
 

TR: [Labrea-users] log format question

[Gordon, L. <Lor...@te...>]

-----Message d'origine-----
De : lorgor
Envoy=E9 : 20 avril, 2004 13:33
=C0 : 'Paul Wefel'
Objet : RE: [Labrea-users] log format question


Sorry to have been almost a week without responding. Have been =
extremely
busy with my day job (who isn't?).

If I'm not mistaken, the * is added by labrea to avoid syslog eating up
entries and giving a "duplicate entries" msg.

The perl tarpit tools work fine as far as I know. I functionally broke =
them
by deciding unilaterally to change the reporting units. I will fix this =
but
this has been on my todo list for at least 6 months and haven't got =
there
yet.

"Persist activity" means Labrea has forced the connection in "persist" =
state
by clamping the window size down to 0. It is responding to a packet and =
is
continuing to throttle down the window size.

"Capturing local IP" means that labrea has seen an ARP for an IP =
address and
has decided to respond back with its bogus ARP. Unless a real machine
corrects the situation, labrea will take over the IP.

"Additional activity" is basically everything that is not "persist
activity".

If you get something together that can be distributed, let me know, and =
I'll
mention it on the website.

lorgor

-----Message d'origine-----
De : Paul Wefel
Envoy=E9 : 14 avril, 2004 18:12
=C0 : lab...@li...
Objet : [Labrea-users] log format question


I am experimenting with labrea on a FreeBSD 4.9 box using it to tarpit=20
an empty /17.  I haven't been able to make the perl tarpit reporting=20
tools operate in a reliable manner with the extreme amount of activity=20
this box is handling (I am quite impressed with how well LaBrea works:  =

4Mb/s of traffic and climbing).

I am working on my own reporting tools and have come across a couple=20
questions about the logs.
What does the * represent at the end of some entries?
What is the significance of the 'Linux persist activity' log statement?
Does the 'Capturing local ip' refer to LaBrea tarpitting a scan to that =

local ip address?
What is the difference between 'Additional activity' and 'Persist=20
Activity'

Thank you,

-paul




-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=3D1470&alloc_id=3D3638&op=3Dcl=
ick
_______________________________________________
Labrea-users mailing list
Lab...@li...
https://lists.sourceforge.net/lists/listinfo/labrea-users

[Labrea-users] log format question

[Paul W. <pw...@nc...>]

I am experimenting with labrea on a FreeBSD 4.9 box using it to tarpit 
an empty /17.  I haven't been able to make the perl tarpit reporting 
tools operate in a reliable manner with the extreme amount of activity 
this box is handling (I am quite impressed with how well LaBrea works:  
4Mb/s of traffic and climbing).

I am working on my own reporting tools and have come across a couple 
questions about the logs.
What does the * represent at the end of some entries?
What is the significance of the 'Linux persist activity' log statement?
Does the 'Capturing local ip' refer to LaBrea tarpitting a scan to that 
local ip address?
What is the difference between 'Additional activity' and 'Persist 
Activity'

Thank you,

-paul

TR: [Labrea-users] sysloging facility

[Gordon, L. <Lor...@te...>]

sorry, install doc has an error.

For any package, ./configure --help should always give you options
supported.

Turns out the correct option is --enable-debug. Double-checked it =
against
configure.in to be sure.

Sorry for the trouble,

lorgor

-----Message d'origine-----
De : Nick Buraglio
Envoy=E9 : 5 avril, 2004 16:37
=C0 : lorgor
Objet : Re: [Labrea-users] sysloging facility


ok, can do.
Also, building with ./configure enable-debugging fails with this error:

tarpit# ./configure enable-debugging
configure: WARNING: you should use --build, --host, --target
checking build system type... Invalid configuration `enable-debugging': =

machine `enable' not recognized
configure: error: /usr/local/bin/bash ./config.sub enable-debugging=20
failed
cluster-cntrl# ./configure --build enable-debugging
checking build system type... Invalid configuration `enable-debugging': =

machine `enable' not recognized
configure: error: /usr/local/bin/bash ./config.sub enable-debugging=20
failed

  I have tried with ./configure --enable-debugging and ./configure=20
--enable-debugging=3Dyes Both fail to add debugging support (I have a=20
feeling this is just user error, but I hope not), at least ./labrea:=20
unrecognized option `--debug' is the error I get after building both of =

those ways.

nb


On Apr 5, 2004, at 3:30 PM, lorgor wrote:

> Nick,
>
> Pls send the trace to me directly.
>
> Thanks,
> lorgor
>
> -----Message d'origine-----
> De : Nick Buraglio
> Envoy=E9 : 5 avril, 2004 16:12
> =C0 : lorgor
> Objet : Re: [Labrea-users] sysloging facility
>
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Using the suggested command parameters still yields no logging.  I'll
>
> hopefully be compiling w/ debugging support today and hope to send =
the
>
> trace to the list soon after.
>
>
>
> Thanks for your help.
>
>
>
> nb
>
>
>
>
>
> On Apr 5, 2004, at 12:33 PM, lorgor wrote:
>
>
>
>> The capture subnet message is normal since you are using a /17. =
Labrea
>
>> gives
>
>> this msg on startup if it thinks the physical subnet size is "too
>
>> big". The
>
>> initial arp sweep of the subnet is not done in this case.
>
>>
>
>> However you should be seeing syslog messages.
>
>>
>
>> Try a cmd line with more "std" parameters such as:
>
>> 	./labrea -z -l -p 100000 -b -i ti0 -s (if on a switch) -v (to be
>
>> sure to see messages)
>
>>
>
>> If that works, and you have time, maybe play with the parameters to=20
>> see
>
>> which combo causes the problem.
>
>>
>
>> If there still is no syslog output, then compile labrea with debug
>
>> support
>
>> 	./configure enable-debugging
>
>>
>
>> and start it with:
>
>>
>
>> 	./labrea --debug 255  ... plus the other parameters
>
>>
>
>> to get debugging output. Be sure that you have reproduced the =
problem
>
>> properly with the debugging outpout turned on, and then send the =
trace
>
>> to
>
>> me.
>
>>
>
>> Could be timer pops are not working on your system for some reason.
>
>>
>
>> Thanks,
>
>>
>
>> lorgor
>
>>
>
>> -----Message d'origine-----
>
>> De : Nick Buraglio
>
>> Envoy=E9 : 5 avril, 2004 12:53
>
>> =C0 : lab...@li...
>
>> Objet : [Labrea-users] sysloging facility
>
>>
>
>>
>
>> -----BEGIN PGP SIGNED MESSAGE-----
>
>> Hash: SHA1
>
>>
>
>> I'm running LaBrea 2.5-stable-1 on FreeBSD 4.9.  LaBrea is being
>
>> started with the command line ./labrea -z -i ti0 -r 1 -H -l -p =
100000
>
>> - -b
>
>> I'm not seeing any messages logged into my syslog facilities, which =
is
>
>> the desired effect.  I've also tried ./labrea -z -i ti0 -r 1 -H -l =
-p
>
>> 100000 -b >> /var/log/labrea This command lines yield the message:
>
>>
>
>> Mon Apr  5 11:13:28 2004  Initiated on interface: ti0
>
>>
>
>> in /var/log/labrea
>
>>
>
>> When I start Labrea I see:
>
>>
>
>> labrea: *** The Capture subnet is large. labrea works better if the
>
>> capture subnet size
>
>> is limited to the actual physical segment size (hub or switch vlan).
>
>> Consider using -n or -m parameters.
>
>>
>
>> my  labrea.conf has:
>
>>
>
>> xxx.xxx.xxx.1-xxx.xxx.xxx.255 EXC
>
>> xxx.xxx.xxx.1-xxx.xxx.xxx.255 EXC
>
>>
>
>> Which reflects 2 /24 subnets in use that need excluded that are =
within
>
>> the /17 that I want to use as a tarpit.
>
>>
>
>> This could very well be user error, printing messages to the console
>
>> works fine so I know I'm seeing traffic.  Any help appreciated, I'd
>
>> really like to syslog this stuff and take full advantage of this =
great
>
>> tool.
>
>>
>
>> nb
>
>>
>
>> -----BEGIN PGP SIGNATURE-----
>
>> Version: GnuPG v1.2.3 (Darwin)
>
>>
>
>> iD8DBQFAcY7dFOm2Sy5bRPQRAqg9AJ4kt46thdcNa/mZK6BvhGvFxV+a1wCcDUm7
>
>> T4moZnRXqeVKQ2CEwxMhcwo=3D
>
>> =3D8Pbh
>
>> -----END PGP SIGNATURE-----
>
>>
>
>>
>
>>
>
>> -------------------------------------------------------
>
>> This SF.Net email is sponsored by: IBM Linux Tutorials
>
>> Free Linux tutorial presented by Daniel Robbins, President and CEO =
of
>
>> GenToo technologies. Learn everything from fundamentals to system
>
>> =
administration.http://ads.osdn.com/?ad_id=3D1470&alloc_id=3D3638&op=3Dcl=
ick
>
>> _______________________________________________
>
>> Labrea-users mailing list
>
>> Lab...@li...
>
>> https://lists.sourceforge.net/lists/listinfo/labrea-users
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.3 (Darwin)
>
> iD8DBQFAcb2bFOm2Sy5bRPQRAtp1AJ9bqegnZGVHr3/Br7eG1XRiFandMQCeJ7Od
> suDZOJ8KJJk3NffvIuLGwWQ=3D
> =3D4fHs
> -----END PGP SIGNATURE-----

TR: [Labrea-users] sysloging facility

[Gordon, L. <Lor...@te...>]

-----Message d'origine-----
De : lorgor=20
Envoy=E9 : 5 avril, 2004 13:34
=C0 : 'Nick Buraglio'
Objet : RE: [Labrea-users] sysloging facility


The capture subnet message is normal since you are using a /17. Labrea =
gives
this msg on startup if it thinks the physical subnet size is "too big". =
The
initial arp sweep of the subnet is not done in this case.

However you should be seeing syslog messages.

Try a cmd line with more "std" parameters such as:
	./labrea -z -l -p 100000 -b -i ti0 -s (if on a switch) -v (to be
sure to see messages)

If that works, and you have time, maybe play with the parameters to see
which combo causes the problem.

If there still is no syslog output, then compile labrea with debug =
support
	./configure enable-debugging

and start it with:

	./labrea --debug 255  ... plus the other parameters

to get debugging output. Be sure that you have reproduced the problem
properly with the debugging outpout turned on, and then send the trace =
to
me.

Could be timer pops are not working on your system for some reason.

Thanks,

lorgor

-----Message d'origine-----
De : Nick Buraglio
Envoy=E9 : 5 avril, 2004 12:53
=C0 : lab...@li...
Objet : [Labrea-users] sysloging facility


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I'm running LaBrea 2.5-stable-1 on FreeBSD 4.9.  LaBrea is being=20
started with the command line ./labrea -z -i ti0 -r 1 -H -l -p 100000=20
- -b
I'm not seeing any messages logged into my syslog facilities, which is=20
the desired effect.  I've also tried ./labrea -z -i ti0 -r 1 -H -l -p=20
100000 -b >> /var/log/labrea This command lines yield the message:

Mon Apr  5 11:13:28 2004  Initiated on interface: ti0

in /var/log/labrea

When I start Labrea I see:

labrea: *** The Capture subnet is large. labrea works better if the=20
capture subnet size
is limited to the actual physical segment size (hub or switch vlan).
Consider using -n or -m parameters.

my  labrea.conf has:

xxx.xxx.xxx.1-xxx.xxx.xxx.255 EXC
xxx.xxx.xxx.1-xxx.xxx.xxx.255 EXC

Which reflects 2 /24 subnets in use that need excluded that are within=20
the /17 that I want to use as a tarpit.

This could very well be user error, printing messages to the console=20
works fine so I know I'm seeing traffic.  Any help appreciated, I'd=20
really like to syslog this stuff and take full advantage of this great=20
tool.

nb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (Darwin)

iD8DBQFAcY7dFOm2Sy5bRPQRAqg9AJ4kt46thdcNa/mZK6BvhGvFxV+a1wCcDUm7
T4moZnRXqeVKQ2CEwxMhcwo=3D
=3D8Pbh
-----END PGP SIGNATURE-----



-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=3D1470&alloc_id=3D3638&op=3Dcl=
ick
_______________________________________________
Labrea-users mailing list
Lab...@li...
https://lists.sourceforge.net/lists/listinfo/labrea-users

[Labrea-users] sysloging facility

[Nick B. <ni...@bu...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I'm running LaBrea 2.5-stable-1 on FreeBSD 4.9.  LaBrea is being 
started with the command line ./labrea -z -i ti0 -r 1 -H -l -p 100000 
- -b
I'm not seeing any messages logged into my syslog facilities, which is 
the desired effect.  I've also tried ./labrea -z -i ti0 -r 1 -H -l -p 
100000 -b >> /var/log/labrea This command lines yield the message:

Mon Apr  5 11:13:28 2004  Initiated on interface: ti0

in /var/log/labrea

When I start Labrea I see:

labrea: *** The Capture subnet is large. labrea works better if the 
capture subnet size
is limited to the actual physical segment size (hub or switch vlan).
Consider using -n or -m parameters.

my  labrea.conf has:

xxx.xxx.xxx.1-xxx.xxx.xxx.255 EXC
xxx.xxx.xxx.1-xxx.xxx.xxx.255 EXC

Which reflects 2 /24 subnets in use that need excluded that are within 
the /17 that I want to use as a tarpit.

This could very well be user error, printing messages to the console 
works fine so I know I'm seeing traffic.  Any help appreciated, I'd 
really like to syslog this stuff and take full advantage of this great 
tool.

nb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (Darwin)

iD8DBQFAcY7dFOm2Sy5bRPQRAqg9AJ4kt46thdcNa/mZK6BvhGvFxV+a1wCcDUm7
T4moZnRXqeVKQ2CEwxMhcwo=
=8Pbh
-----END PGP SIGNATURE-----

TR: [Labrea-users] Couldn't open libdnet link interface

[Gordon, L. <Lor...@te...>]

=20
Yeah.
=20
labrea is still back at WinPcap 2.3.
=20
Did some research (which I should have done before). WinPcap 2.3 =
doesn't
seem to officially support XP.
=20
So I would recommend waiting until I get a version out that supports =
WinPcap
3.0. Which might mean helping get libdnet support in place as well.
=20
Will update the labrea web site to take out the mention of XP support.
=20
Sorry for your trouble and thanks for your post that helped get my act
together.
=20
lorgor

-----Message d'origine-----
De : Mike Arduo
Envoy=E9 : 4 avril, 2004 15:04
=C0 : lab...@li...
Objet : [Labrea-users] Couldn't open libdnet link interface


How do i run Labrea? I'm logged in as Admin on my WinXP SP1. I have =
WinPcap
3 (latest stable) installed then reboot. I'd like to do all the neat =
things
Labrea promises.
=20
This machine has 2 NICs, the 2nd one is unplugged and also disabled. =
WinDump
and Ethereal works fine here.
=20
Thanks!
=20
Mike
=20

My output:
=20

C:\WINDOWS\system32>labrea -V
LaBrea 2.5-stable-1 lorgor@
Sun Apr 04 10:56:40 2004  Labrea exiting...
=20
C:\WINDOWS\system32>labrea -T
*** You're missing the "-z" flag. See the docs.
Sun Apr 04 10:56:49 2004  LaBrea will attempt to capture unused IPs.
Sun Apr 04 10:56:49 2004  Full internal BPF filter: arp or (ip and =
ether dst
hos
t 00:00:0F:FF:FF:FF)
Sun Apr 04 10:56:49 2004  LaBrea will log to stdout
Sun Apr 04 10:56:49 2004  Logging will be very verbose.
*** Errors in input - exiting.
*** Couldn't open libdnet link interface
Sun Apr 04 10:56:49 2004  Labrea exiting...
=20
C:\WINDOWS\system32>labrea -D
=20
*** WinPcap device list
=20
* Labrea uses Winpcap to sniff the network.
The following is the list of Winpcap devices.
The default is to use the first device in the list.
* To override this behaviour and select device "n", specify
                -j n
=20
1- \Device\NPF_{F8F7368E-201D-4235-A981-0CBC807F680A}
        SiS NIC SISNIC (Microsoft's Packet Scheduler)
=3D=3D=3D> Default device
=20
*** End of WinPcap device list ***
=20

*** Libdnet interface list ***
=20
* Labrea uses libdnet to write packets, determine IP addr, etc.
Labrea looks through the following list for the the first Ethernet
interface that is not the loopback interface.
* To override this behaviour and select interface "ethn", specify:
                        -i ethn
or manually specify the values to use:
           -I nnn.nnn.nnn.nnn -E xx:xx:xx:xx
* Note that the libdnet interface and the Winpcap device MUST refer to =
the
same physical NIC (network interface card).
=20
1    eth0:
        inet 192.168.1.102 netmask 0xffffff00
        link 00:d0:09:79:55:de
=3D=3D=3D> Default interface
=20
2    lo0:
        inet 127.0.0.1 netmask 0xff000000
*** End of libdnet interface list ***
Sun Apr 04 10:56:55 2004  Labrea exiting...
=20
C:\WINDOWS\system32>labrea
You MUST read the INSTALL file!  Don't try to run this
program without understanding how it works and what it can do!
In the INSTALL file, you'll find the command line switch
necessary to allow LaBrea to run.
*** Errors in input - exiting.
*** Couldn't open libdnet link interface
Sun Apr 04 10:57:01 2004  Labrea exiting...
=20
C:\WINDOWS\system32>

[Labrea-users] Couldn't open libdnet link interface

[Mike A. <ma...@ya...>]

How do i run Labrea? I'm logged in as Admin on my WinXP SP1. I have WinPcap 3 (latest stable) installed then reboot. I'd like to do all the neat things Labrea promises.
 
This machine has 2 NICs, the 2nd one is unplugged and also disabled. WinDump and Ethereal works fine here.
 
Thanks!
 
Mike
 

My output:
 

C:\WINDOWS\system32>labrea -V
LaBrea 2.5-stable-1 lo...@us...
Sun Apr 04 10:56:40 2004  Labrea exiting...
 
C:\WINDOWS\system32>labrea -T
*** You're missing the "-z" flag. See the docs.
Sun Apr 04 10:56:49 2004  LaBrea will attempt to capture unused IPs.
Sun Apr 04 10:56:49 2004  Full internal BPF filter: arp or (ip and ether dst hos
t 00:00:0F:FF:FF:FF)
Sun Apr 04 10:56:49 2004  LaBrea will log to stdout
Sun Apr 04 10:56:49 2004  Logging will be very verbose.
*** Errors in input - exiting.
*** Couldn't open libdnet link interface
Sun Apr 04 10:56:49 2004  Labrea exiting...
 
C:\WINDOWS\system32>labrea -D
 
*** WinPcap device list
 
* Labrea uses Winpcap to sniff the network.
The following is the list of Winpcap devices.
The default is to use the first device in the list.
* To override this behaviour and select device "n", specify
                -j n
 
1- \Device\NPF_{F8F7368E-201D-4235-A981-0CBC807F680A}
        SiS NIC SISNIC (Microsoft's Packet Scheduler)
===> Default device
 
*** End of WinPcap device list ***
 

*** Libdnet interface list ***
 
* Labrea uses libdnet to write packets, determine IP addr, etc.
Labrea looks through the following list for the the first Ethernet
interface that is not the loopback interface.
* To override this behaviour and select interface "ethn", specify:
                        -i ethn
or manually specify the values to use:
           -I nnn.nnn.nnn.nnn -E xx:xx:xx:xx
* Note that the libdnet interface and the Winpcap device MUST refer to the
same physical NIC (network interface card).
 
1    eth0:
        inet 192.168.1.102 netmask 0xffffff00
        link 00:d0:09:79:55:de
===> Default interface
 
2    lo0:
        inet 127.0.0.1 netmask 0xff000000
*** End of libdnet interface list ***
Sun Apr 04 10:56:55 2004  Labrea exiting...
 
C:\WINDOWS\system32>labrea
You MUST read the INSTALL file!  Don't try to run this
program without understanding how it works and what it can do!
In the INSTALL file, you'll find the command line switch
necessary to allow LaBrea to run.
*** Errors in input - exiting.
*** Couldn't open libdnet link interface
Sun Apr 04 10:57:01 2004  Labrea exiting...
 
C:\WINDOWS\system32>



---------------------------------
Do you Yahoo!?
Yahoo! Small Business $15K Web Design Giveaway - Enter today

TR: [Labrea-users] Which version of WinPcap?

[Gordon, L. <Lor...@te...>]

-----Message d'origine-----
De : Gordon, Loren=20
Envoy=E9 : 26 f=E9vrier, 2004 13:49
A : Antal
Objet : RE: [Labrea-users] Which version of WinPcap?


From the INSTALL information in the source code tarball:

"You will need to install WinPcap 2.3. Do not use WinPcap 3.0. (or =
later)

 LaBrea needs admin privileges on Windows NT and later."

Should run on XP but haven't tested it. Any comments?

loren


-----Message d'origine-----
De : Antal
Envoy=E9 : 26 f=E9vrier, 2004 05:47
A : lab...@li...
Objet : [Labrea-users] Which version of WinPcap?


Hello List,

Reading recent emails I see that WinPcap 3.1 beta is not working well
with LaBrea.
Please, let me know which does?
And how should LaBrea start working on XP?
Thnaks for help
Antal

TR: [Labrea-users] Listening on multiple logical segments con't

[Gordon, L. <Lor...@te...>]

Good follow-on question,

lorgo

-----Message d'origine-----
De : lorgor
Envoy=E9 : 27 f=E9vrier, 2004 10:14
=C0 : keith
Objet : RE: [Labrea-users] Listening on multiple logical segments


When labrea gives a message about the subnet being too big, it is =
saying
that certain function will disabled (i.e. initial ARP sweep). This =
occurs if
the capture subnet is bigger than 1024 addresses. The idea is that even =
a
single big switch normally doesn't have more than this number of =
attached
devices. And you don't want some program blasting out thousands of =
ARPs. Can
cause the production switch to start behaving like a hub, or do other =
things
that will make the network folks unhappy.

The arp sweep allows labrea to proactively find out what is connected =
to the
local segment and what IP addresses are not used. However labrea should =
work
fine without the arp sweep.

The bottom line is this. If labrea can allocate its arrays and run, =
then it
should work, even if the capture subnets are huge.

However a /19 subnet has only 8192 elements if my math is correct. The
corresponding labrea arrays will not be that big; labrea should run
properly.

-------------------------

So you should run one instance of labrea with a /19 capture subnet, and
exclude the production subnets using the config file statements.

lorgor


-----Message d'origine-----
De : Keith=20
Envoy=E9 : 23 f=E9vrier, 2004 14:27
=C0 : lorgor
Objet : RE: [Labrea-users] Listening on multiple logical segments


Capture subnet is /19 and it says way too big. I tested running
two instances concurrently with no apparent ill affects other than
conflicting log file entries like:
x.y.z.q not my network
x.y.z.q captured
I tried manually defining with the -n argument as I said
but you can only define one. If you define more than one only the
last one is remebered. What about instead of capturing multple
networks or subnets how about just a larger network or supernet
something like x.x.x.x/19 (32 class C's)? and then as you say
I can add entries to the conf for it to ignor. Still require
major surgury?
-Keith


> -----Original Message-----
> From: lorgor
> Sent: Monday, February 23, 2004 9:44 AM
> To: keith
> Subject: RE: [Labrea-users] Listening on multiple logical segments
>=20
>=20
> Keith,
>=20
> Your comment is correct. Labrea handles only one capture subnet.
>=20
> Am at home recovering from a sinus operation (not your=20
> problem!) so can't
> fool around with tests.
>=20
> The idea of running multiple instances of labrea is one I=20
> haven't tested.
> Does it work correctly for you?
>=20
> Will it work in general? Depends on libdnet. FWIW can't think=20
> of any reason
> off-hand. YMMV.
>=20
> Why didn't you define a larger address space and then use the=20
> configuration
> file "exclude" to tell labrea not to touch the live blocks?=20
> (ie capture
> "everything" but don't touch this or this or that) Too much=20
> work / too many
> disjointed class C subnets? Capture subnet too big?
>=20
> You can manually define the capture subnet using the=20
> --network parameter.
> With CIDR notation (xx.xx.xx.xx/nn), you can specify the=20
> subnet mask as
> well. This would be another way to get one instance of labrea=20
> to not capture
> the other one's subnets.
>=20
> I've always thought labrea had too much flexibility / too=20
> many parameters.
> However your need is new (to me) and is reasonable.
>=20
> Labrea could be modified to handle multiple capture subnets,=20
> but this would
> require major surgery. Would have to hear from others that=20
> this is generally
> required before deciding to invest the time and effort=20
> required to do the
> modification.
>=20
> Thanks for a very interesting question. Hope this helps,
>=20
> lorgor
>=20
> -----Message d'origine-----
> De : Keith
> Envoy=E9 : Thursday, February 19, 2004 10:05 AM
> =C0 : lab...@li...
> Objet : [Labrea-users] Listening on multiple logical segments
>=20
>=20
> Hello Labrea list,
> I'm running Labrea on a physical segment that "sees"
> ARP whois resquest broadcasts on multiple logical networks
> i.e. more than one class C block or subnets thereof.
> I could not find a way to tell Labrea to handle more
> than one block of addresses so I tested running two
> instances of Labrea passing the second block with a -n=20
> argument. The log output shows addresses from both blocks
> being captured. Question: Is this the most efficient way
> to accomplish what I want (running a separate instance for each
> address block)? Would I run into a problem other than
> resource consumption if I ran say 8 or 16 or 32 instances
> of Labrea on the same box each handling a different logical network?
> Is there a way to specify multiple blocks in the conf or
> CLI for a single instance?
> -Keith
>=20
>=20
>=20
> -------------------------------------------------------
> SF.Net is sponsored by: Speed Start Your Linux Apps Now.
> Build and deploy apps & Web services for Linux with
> a free DVD software kit from IBM. Click Now!
> http://ads.osdn.com/?ad_id=3D1356&alloc_id=3D3438&op=3Dclick
> _______________________________________________
> Labrea-users mailing list
> Lab...@li...
> https://lists.sourceforge.net/lists/listinfo/labrea-users
>=20

[Labrea-users] TR: La Brea vs Dhcp

[Gordon, L. <Lor...@te...>]

Interesting question ...

lorgor

-----Message d'origine-----
De : Michael
Envoy=E9 : 25 ao=FBt, 2003 15:40
=C0 : 'Gordon, Loren'
Objet : RE: La Brea


Loren,

thanks for your reply. Sorry to hear LaBrea won't handle DHCP. Maybe in =
the
furure(hint hint). Would it be possible to have Labrea poll the DHCP =
server
for the ip addresses in use at that moment and then eliminate them from =
the
list of ip's it "camps" on? I'm thinking LaBrea could be a very =
valuable
tool to entriprise networks and ISP's. These days DHCP is the default =
in
large networks. iwas hoping to present this to my bosses at work who =
have
been going nuts because of all the port scan activity lately on our
networks. Anyway thanks for your reply and congrats on a very sweet =
tool.

Mike
-----Original Message-----
From: Gordon, Loren
Sent: Monday, August 25, 2003 6:25 AM
To: Michael
Subject: RE: La Brea


LaBrea and dhcp don't live too well together. LaBrea "camps on" the =
unused
IPs and the Dhcp server blithely allocates them. Or worse yet, pings =
them
and discovers "something" is there. Better to allocate Dhcp to some =
range of
addresses and let LaBrea handle some other range of addresses.

The question about multiple subnets is a good one. I don't think Labrea =
in
its current form will handle more than 1 subnet (IE capture range) per =
NIC.
If multiple NICs were used, or possible aliases on the same NIC, I =
think
multiple instances of Labrea would be required. However I have never =
heard
of anyone running multiple Labreas in the same machine.

Some other quick thoughts / info. Have you looked at honeyd? Secondly,
labrea-beta is almost to stable code. Have been too busy to get it done
completely. Might be a better choice for you than current =
labrea-stable.

loren



-----Message d'origine-----
De : Michael
Envoy=E9 : 24 ao=FBt, 2003 15:29
=C0 : 'lo...@us...'
Objet : La Brea


Our users have dynamic ip addresses. Could LaBrea be configured to
dynamically "tarpit" only the unused ip's at that moment? Also, we use
multiple subnets and lots of different masks to seperate users of =
different
types. Would multiple nic's be needed for each subnet or could LaBrea =
handle
perhaps thousands of available (unused) ip addresses on hundreds of =
subnets?
I know this is asking alot but I'd be interested in knowing if one huge
beast of a machine with multiple eth connections (like a Sun Box) could
handle this. Thanks.

BTW, I really love this idea. LaBrea is brilliant.

Mike