[Labrea-users] Re: Configuration problem - tarpitting machine on local subnet

[Mike B. <bro...@ho...>]

Ed:

I run 2.5-Stable-1 on a couple machines on completely different networks 
(was that you I've seen pulling stats from one of them with Michael's 
script? ;D ). One is running Fedora Core 1 and the other is RH 9.0 and I 
haven't seen the problem of tarpitting local machines.  That being said, I 
should also say that there are no Windows machines on those subnets.

I certainly do exclude addresses though and have never had the tarpit step 
out-of-bounds and overtake occupied addresses.  I put EXC lines in 
/usr/local/etc/labrea.conf and it works fine.  I didn't see anything in the 
documentation that explicilty said you could put more than one EXC or IPI 
line in the .conf but I did it and it appears to work.

You said you did an IPI but have you tried a POR to block those ports?  Not 
that this would be an ultimate solution but it would be another data point.  
At a guess, I would say if IPI and POR don't work for your 139/445/local 
hosts problem and EXC doesn't work for your overtake problem, Labrea is not 
reading the config file.  Could you have some conflicts from your old 
install?  Looking at a different config file?

What does it say when you start it manually (non-daemon mode)?  It should 
dump out some results as it parses the .conf file.

_________________________________________________________________
Don’t just search. Find. Check out the new MSN Search! 
http://search.msn.click-url.com/go/onm00200636ave/direct/01/