I've been testing 6.x httpbl all week, from a site host standpoint, and it's looking good. That is, I know I'm trapping malicious traffic, both grey and blacklisted, blacklisted sites are being added to the {access} table as banned traffic, and cron is removing these rows from both the {access} and {httpbl} tables when they expire.

What I can't figure out though is how on earth do you test to see what this looks like from the user perspective, if they turned out to be grey or blacklisted? I presume it is difficult to "impossible" to spoof a malicious IP, otherwise they'd be spoofing as the good ones.

So how do you test what the user should see if they turn up positive as bad traffic in honeypot? Any suggestions?

Comments

praseodym’s picture

praseodym commented
Assigned: Unassigned » praseodym

Actually testing is quite easy.
Replace line 153 by:
$ip = '127.1.20.1';
for a greylisted user and replace it by
$ip = '127.1.80.1';
for a blacklisted user.

Check out the 'Test values' section on http://www.projecthoneypot.org/httpbl_api.php for more info.

Let me know your testing results!

bryrock’s picture

bryrock commented
Status: Active » Fixed

Your right. That was easy enough. Thanks.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.