Honeyd Concepts

People often wonder what honeypots can be used for. Here are some examples on how Honeyd and honeypots in general can be used to improve security or for network measurements.

Wireless Honeypot

Setup an isolated machine running Honeyd:

Run an access point. This can be done with Linux or *BSD by putting a wireless card into hostap mode and using it to create a wireless network.
Configure and run a DHCP server. You need to determine which network the DHCP server should hand addresses out for, e.g. 192.168.0.0/16. The router and name server records need to to point to IP addresses simulate by Honeyd.
Instrument Honeyd to provide fake Internet topology. This can be achieved by configuring a virtual network topology for the whole IP address space except for the address range that is served by DHCP. Make sure that you have a name server running that resolves names. This can be done without the laptop being connected to the Internet itself.

Diagram showing wireless honeypot configuration.

Monitor for unauthorized access:

Run an intrusion detection system or monitor services for abuse or interesting activity.
Set up spam traps and open proxies to see if spammers use unsecured wireless access points to send spam.

Integrated Honeypots

Distract adversaries by mixing virtual honeypots into your production network:

Use either Arpd or a recent version of Honeyd with ethernet-level simulation to redirect traffic for unused IP addresses. Ethernet-level simulation can be turned on by using: set template ethernet "00:aa:bb:cc:dd:ee"
Set up Honeyd to simulate virtual honeypots for the redirected IP addresses.

Monitor for unauthorized access:

Run an intrusion detection system or monitor services for abuse or interesting activity.
Detect compormised machines by watching who probes the honeypots.

Just by running honeypots, you make live harder for adversaries because they might waste their resources by breaking into the honeypots. Honeypots can also serve as a warning sign for a highly monitored network.

Diagram showing an integrated honeypot configuration.

If you are missing a concept, please let me know.