# make honeypot reachable through localhost
up route -n add -net 20.0.0.0/24 gw 127.0.0.1

# Defaults for honeyd initscript
RUN="yes"
INTERFACE="lo"
NETWORK=20.0.0.0/24
OPTIONS="--disable-webserver"
#OPTIONS="--fix-webserver-permissions"

create winxp
set winxp personality "Microsoft Windows XP Professional SP1"
set winxp default tcp action reset
set winxp default udp action block
set winxp default icmp action open
add winxp tcp port 23 "sh scripts/telnet/faketelnet.pl"

bind 20.0.0.100 winxp

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         10.0.0.1        0.0.0.0         UG    0      0        0 ens160
10.0.0.0        *               255.255.255.0   U     0      0        0 ens160
20.0.0.0        localhost       255.255.255.0   UG    0      0        0 lo

$ service honeyd start
Job for honeyd.service failed because the control process exited with error code. See "systemctl status honeyd.service" and "journalctl -xe" for details.

$ service honeyd status
● honeyd.service - LSB: Service to simulate hosts and networks
   Loaded: loaded (/etc/init.d/honeyd; bad; vendor preset: enabled)
   Active: failed (Result: exit-code) since Mon 2017-01-23 17:36:02 CET; 1min 19s ago
     Docs: man:systemd-sysv-generator(8)
  Process: 1529 ExecStart=/etc/init.d/honeyd start (code=exited, status=1/FAILURE)
    Tasks: 2
   Memory: 12.0M
      CPU: 47ms
   CGroup: /system.slice/honeyd.service
           ├─1550 /usr/bin/honeyd -f /etc/honeypot/honeyd.conf -l /var/log/honeypot/honeyd.log -p /etc/honeypot/nmap.prints -a /etc/honeypot/nmap.assoc -0 /etc/honeypot
           └─1552 /usr/bin/rrdtool -

Jan 23 17:36:02 ubuntu-srv honeyd[1529]:  * Starting Honeyd daemon honeyd
Jan 23 17:36:02 ubuntu-srv honeyd[1549]: started with -f /etc/honeypot/honeyd.conf -l /var/log/honeypot/honeyd.log -p /etc/honeypot/nmap.prints -a /etc/honeypot/nmap.as
Jan 23 17:36:02 ubuntu-srv honeyd[1549]: listening on lo: ip and (dst net 20.0.0.0/24)
Jan 23 17:36:02 ubuntu-srv honeyd[1529]:  * ERROR while starting please check /var/log/honeypot/daemon.log
Jan 23 17:36:02 ubuntu-srv honeyd[1529]:    ...fail!
Jan 23 17:36:02 ubuntu-srv systemd[1]: honeyd.service: Control process exited, code=exited status=1
Jan 23 17:36:02 ubuntu-srv systemd[1]: Failed to start LSB: Service to simulate hosts and networks.
Jan 23 17:36:02 ubuntu-srv systemd[1]: honeyd.service: Unit entered failed state.
Jan 23 17:36:02 ubuntu-srv systemd[1]: honeyd.service: Failed with result 'exit-code'.
Jan 23 17:36:02 ubuntu-srv honeyd[1550]: Demoting process privileges to uid 111, gid 117

Mon, 23 Jan 2017 17:36:02 +0100 - Starting honeyd
Honeyd V1.5c Copyright (c) 2002-2007 Niels Provos
honeyd[1549]: started with -f /etc/honeypot/honeyd.conf -l /var/log/honeypot/honeyd.log -p /etc/honeypot/nmap.prints -a /etc/honeypot/nmap.assoc -0 /etc/honeypot/pf.os -x /etc/honeypot/xprobe2.conf -u 111 -g 117 --disable-webserver -i lo 20.0.0.0/24
honeyd[1549]: listening on lo: ip and (dst net 20.0.0.0/24)
Honeyd starting as background process

$ ps aux | grep honeyd
honeyd    1550  0.0  0.7  31896  7124 ?        Ss   17:36   0:00 /usr/bin/honeyd -f /etc/honeypot/honeyd.conf -l /var/log/honeypot/honeyd.log -p /etc/honeypot/nmap.prints -a /etc/honeypot/nmap.assoc -0 /etc/honeypot/pf.os -x /etc/honeypot/xprobe2.conf -u 111 -g 117 --disable-webserver -i lo 20.0.0.0/24
honeyd    1552  0.0  1.1 126164 11180 ?        S    17:36   0:00 /usr/bin/rrdtool -

$ ping 20.0.0.100
PING 20.0.0.100 (20.0.0.100) 56(84) bytes of data.
64 bytes from 20.0.0.100: icmp_seq=1 ttl=128 time=23.6 ms
64 bytes from 20.0.0.100: icmp_seq=2 ttl=128 time=13.8 ms