Bits of honeypot (LaBrea)

[Gustavo Franco <stratus@acm.org>]

Hi,

Anybody here is running LaBrea in your firewall? I've one
question.

I've the environment described below:

router <-->  eth1--[fw]--eth0 <--> firewalled servers

eth0 is:
address 200.219.1.2
netmask 255.255.255.224
broadcast 200.219.1.31

eth1 is:
'real' ip address.

firewalled servers are:
'real' ip address.


Running:
'tcpdump -i eth1 arp' i can see arp requests coming from
world, and after running LaBrea with this syntax:
./LaBrea -i eth1 -s -l -v -q -R -b -z

I've a honeypot running only from/to firewalled servers and
not from world to firewalled servers.What's my error?

Thanks in advance,
--
Gustavo R. Franco -- <stratus@acm.org>