search

mushorg / conpot

ICS/SCADA honeypot
GNU General Public License v2.0
1.22k stars 413 forks source link

Guardian_ast generating alert for one time! #441

Open prashantvidja opened 5 years ago

prashantvidja commented 5 years ago

Hello,

I have deployed conpot image. and I have test guardian_ast using below command.

nmap -p 10001 -A -v -Pn 192.168.56.111

And also it's generating alert. But when I am fire upper command then don't get any error.

After I need to restart docker container and again I get error one time.

Thanks Prashant

prashantvidja commented 5 years ago

Hello,

One thing I have found that. When i am start scanning then One connection established after that it is not disconnected even if i stop scanning. (kill nmap scanner) That's why I think it is not possible to connect again. I am pasting log here please check it and help me out from this issue.

2019-03-22 10:18:02,121 Conpot GuardianAST initialized 2019-03-22 10:18:02,123 Found and enabled guardian_ast protocol. 2019-03-22 10:18:02,125 No proxy template found. Service will remain unconfigured/stopped. 2019-03-22 10:18:02,126 GuardianAST server started on: ('0.0.0.0', 10001) 2019-03-22 10:18:22,011 New guardian_ast session from 192.168.56.1 (44978cd2-be78-49ec-8fa8-c7052d7fd1bd) 2019-03-22 10:18:22,012 New GuardianAST connection from 192.168.56.1:56856. (44978cd2-be78-49ec-8fa8-c7052d7fd1bd) 2019-03-22 10:18:28,017 Non ^A command attempt 192.168.56.1:56856. (44978cd2-be78-49ec-8fa8-c7052d7fd1bd) 2019-03-22 10:18:28,017 GuardianAST client disconnected 192.168.56.1:56856. (44978cd2-be78-49ec-8fa8-c7052d7fd1bd) 2019-03-22 10:18:28,019 New GuardianAST connection from 192.168.56.1:56860. (44978cd2-be78-49ec-8fa8-c7052d7fd1bd)

Thanks & Regards