mushorg / conpot

ICS/SCADA honeypot
GNU General Public License v2.0
1.22k stars 413 forks source link

Conpot keeps restarting #468

Closed PersonaN0nGrata closed 4 years ago

PersonaN0nGrata commented 4 years ago

It worked for a while, and then all of the sudden it just started breaking constantly conpot.log looks like this: image image

its been deployed with MHN

creolis commented 4 years ago

Hey! Is there any way to get a better view at your logs?

First of all, screenshots are really inconvenient since they are an accessibility nightmare and they can't be indexed and searched -> but more importantly in your case is that all important messages are truncated, so we have virtually no information to start with..

PersonaN0nGrata commented 4 years ago

conpot.log

I think this is the best i can do. I cant seem to copy from nano

creolis commented 4 years ago

Oh it's fine, now we can actually read what's going on :)

2019-10-09 10:11:51,828 Stopping because <Greenlet at 0x7fa02f969890: <bound method HTTPServer.start of <conpot.protocols.http.web_server.HTTPServer object at 0x7fa02f92e110>>('0.0.0.0', 80)> died: [Errno 98] Address already in use

Did you try to resolve this?

PersonaN0nGrata commented 4 years ago

Not sure what it means. Is port 80 busy with something else?


edit* ahh shit i think maybe my Dionaea was also using port 80

creolis commented 4 years ago

ahh shit i think maybe my Dionaea was also using port 80

;-) Well, that was an easy one. btw.: if you want to find out which process grabbed port 80, try

sudo netstat -anp | grep LISTEN | grep -v LISTENING | grep 80 | awk '{print $7}'

(root permissions are used to resolve the PID)