I have Honeyd installed in my Mandrake Linux 9 box.
I can tell you little bit about Honeyd.
Advantage of Honeyd:
- Can monitor any UDP or TCP port and entire networks
- It's free...(the best thing about Open Source)
- Resist fingerprinting efforts by emulating operating systems at IP stack level as well as the application level
Disadvantage of Honeyd:
- As low-interaction solution, it cannot provide real Operating System for attackers to interact with.
- As an OpenSource solution, it provides no formal support for maintenance and troubleshooting.
- No built-in mechanism for alerting,nor any mechanism for capturing extensive information.
At the moment I've been setting up my "other honeypot" (if you search google you will find differents kind of "honeypot" and I think the easy one is "BOF" stand for BackOfficer Friendly, BOF is low-interaction honeypot.




Reply With Quote