[Labrea-users] Can't specify single IP addresses

[Eric H. <eri...@ap...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

All,

I posed this question here once before and we ended up trying /23
networks and then eliminated IPs manually in the labrea.conf to try and
achieve specifying single IP addresses.

I also did not hear back from Loren Gordon on whether or not LaBrea
could be modified to support /32 IP addresses. So I'm now back to this
list for help.

So what I'm going to do is have the customer monitor the entire /24
network and hope that LaBrea does not tarpit IP addresses being used by
any machines. The good news is, its not a DHCP network, every IP address
is statically assigned.

So my question is this, do most if not all of you use LaBrea specifying
ONLY IP addresses you DO NOT use or do most of you specify your entire
network which contains IPs that ARE being used by hosts. If the latter
is the case, have any of you seen LaBrea mistakingly tarpit IP addresses
that are being used by hosts?

Any comments and feedback are appreciated.

- --

Best Regards,

Eric S. Hines, GCIA, CISSP
CEO, President, Chairman
Applied Watch Technologies, LLC


- --------------------------------------------------

Eric S. Hines, GCIA, CISSP
CEO, President, Chairman
Applied Watch Technologies, LLC

- --------------------------------------------------

Email:   eri...@ap...
Address: 1095 Pingree Road
         Suite 221
         Crystal Lake, IL
         60014
Tel:     (877) 262-7593 ext:327
Local:   (847) 854-5831
Fax:     (847) 854-5106
Web:     http://www.appliedwatch.com

- --------------------------------------------------
Security Management for the Open Source Enterprise



-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFFCZFQ1va6QYTV0EMRAtnGAJ4o2biI3nt/P+tTWEjHYgZ5ZodheACeI3mu
JnN6VApJABnV7SMyLUHyymE=
=nXiE
-----END PGP SIGNATURE-----