82 The State of the Art in Intrusion Prevention and Detection
emulate the operating systems. For example, your honeypot can easily emulate a Solaris operating
system (OS), but the real operating system of your honeypot is Windows. Attackers can detect just
such a trick! How? If the attacker uses advanced operating system detection techniques, such as
analyzing the IP stack of the honeypot, the attacker may identify the system as a Windows-based
OS! Honeypots that run real operating systems, such as a honeynet, can reduce such problems.
3.6.9 Maintaining a honeypot
Now, we have deployed our honeypot. There still remains another important step, which is main-
taining the honeypot. Implementation is only half of any honeypot system. Maintenanc ...