even sends data with the lone ACK, so you can see what he is up to.

Reset

This is the so-called Reset kill or as the Snort folks say, session sniping. I have serious reservations about this technique. The Reset kill can tear down someone else's TCP connection, and I have seen commercial IDS systems fire these kills based on false positives. The idea is if you see a TCP connection that has been established and the IDS detects a signature that requires action, you forge two Resets and send one to both sides to blow off the connection. It used to be possible simply to smack the initiating host, but attackers are learning to ignore Resets. This isn't used all that often, although it is available in Snort and commercial intrusiondetection systems.

Honeypot

An advanced site, in conjunction with throttling, can use its router to direct the attacker to a specially instrumented system called a honeypot. The honeypot could be used as a stand-in for the targeted host. We also have used honeypots with static addresses as stand-ins for internal hosts that have become "hot."

Every once in a while, a host that you are protecting will suddenly stir up a lot of interest and you will keep seeing probes and exploit attempts directed to it. In such a situation, a fun course of action is to change both its name and IP address and install a honeypot in its place. However, the most common use we have at www.incidents.org for honeypots is to figure out what the attackers are doing by catching their attack in a honeypot. I have tried three types of honeypots: a proxy system, the Deception Tool Kit (DTK), and an "empty" computer, the Honeynet approach.

Proxy System

During 1996 and 1997, I did a lot of research into hacker technology. The goal of the project was to collect as many exploit tools as possible. I took a Sun computer running SunOS 4.1.3, patched it as best I could, and installed the TIS toolkit. The system was named cray3. I copied an /etc/motd from a Unicos system and did everything I could to make it look like a cray. Thank goodness this was before TCP fingerprinting.

I used the TIS toolkit for the target services, ftp, telnet, SMTP, and so forth. Finally, I compiled Internet Relay Chat (IRC). The idea was to spend time on the hacker IRC channels, exchange code, get people to attack my system, and collect the techniques they used. There was only one small problem. I had never been on IRC! I knew that if I didn't do it right that I would show up like I had five legs and a tail. So what to do? I decided to start in a channel other than #hack. So I tried #thirtysomething. I have never been good at flirting, so I ended up wasting hours watching words fly by on the screen.

Next, I decided to try #Jesus. I figured church people would be nice to me. BZZZZT, they kicked me off within 10 minutes. I was really crushed!

Finally, in frustration, I signed on to the #abortion channel because that was what was about to