Honeypot Concepts
People often wonder what honeypots can be used
for. Here are some examples on how Honeyd and honeypots in general can be
used to improve security or for network measurements.
Wireless Honeypot
Setup an isolated machine running Honeyd:
- Run an access point. This can be done with Linux or *BSD by
putting a wireless card into
hostap mode and using it
to create a wireless network.
- Configure and run a
DHCP server. You need to
determine which network the DHCP server should hand addresses out
for, e.g. 192.168.0.0/16 . The router and name server
records need to to point to IP addresses simulate by Honeyd.
- Instrument Honeyd to provide fake
Internet topology. This can be achieved by configuring a
virtual network topology for the whole IP address space except for
the address range that is served by DHCP. Make sure that you have
a name server running that resolves names. This can be done
without the laptop being connected to the Internet itself.
|
Diagram showing wireless honeypot
configuration. |
Monitor for
unauthorized access:
- Run an intrusion detection system or monitor services for abuse or
interesting activity.
- Set up spam traps and open proxies to see if spammers use unsecured
wireless access points to send spam.
Integrated Honeypots
Distract adversaries by mixing virtual honeypots into
your production network:
- Use either Arpd
or a recent version of Honeyd with ethernet-level simulation to
redirect traffic for unused IP addresses. Ethernet-level
simulation can be turned on by using:
set template ethernet
"00:aa:bb:cc:dd:ee"
- Set up Honeyd to simulate virtual honeypots for the redirected
IP addresses.
Monitor for unauthorized access:
- Run an intrusion detection system or monitor services for
abuse or interesting activity.
- Detect compormised machines by watching who probes the
honeypots.
Just by running honeypots, you make live harder
for adversaries because they might waste their resources by breaking
into the honeypots. Honeypots can also serve as a warning sign for a
highly monitored network. |
Diagram showing an integrated honeypot
configuration. |
If you are missing a concept, please let me know.