Honeypots: Tracking Hackers

Port-Monitoring Honeypots

If you have never worked with honeypots, or have never developed your own, port monitoring is where you want to start. Because port-monitoring honeypots supply only a limited function for a specific service, they are very easy to build, deploy, and maintain. You can use a port listening program to listen on specific ports and record all activity that connects to them. This program creates on open socket that listens on the port and passively logs any connections made to it. The honeypot has no intelligence; it only creates a connection and then waits for the attacker to send data. A second option is to build a customized port-monitoring application that emulates a specific service. This solution has the intelligence ...