I've decided to setup a honeypot to capture viruses/botnet to reverse engineer them and getting to know how the work, where they come from etc...for that I setup nepenthes running on ubuntu virtual machine, and I opened a hole on my firewall to that machine, pretty much redirecting all traffic that hits the firewall to the virtual box, in less than 3 hours I started to get hit with what appears to be botnet for DDos from ip address in China, but nepenthes sends the virus to a website for analysis, and the virus is no where to be found in the system.....instead I want to be able to capture and analyze them myself...does anyone know a better way to accomplish this?


Thanks in advance