I am currently working on some projects involving honeyd, farpd and nmap. Scanning a honeyd host with nmap which is on the same network as the farpd daemon will result in a host is down response. The problem lies in the fact that by default nmap sends an ARP ping instead of an ICMP ping for an IP which is in the same network. To mitigate this problem the following parameter should be used:
nmap --send-ip 172.16.0.2
This will result in nmap sending raw IP packets.
Powered by FireStats