Honeypots: Tracking Hackers

Deploying and Maintaining Honeyd

When deploying a Honeyd honeypot, the first thing you must decide is what mode you want the Honeyd to run in. Do you want to use Honeyd as a blackholing solution, where it monitors entire networks that have no active systems? That means any connection made to any system on a specific network is suspect by nature. Or do you want to deploy Honeyd on a production network, one that has both valid and nonexistent systems? How you want to use Honeyd will determine how it is deployed.

Blackhole deployments involve identifying which router you will be using to route the traffic for the entire network. Once you have identified that router, you simply deploy your Honeyd honeypot to work directly with that router, as we ...