happen to my project. They were some great folks, although strongly polarized on both sides of the issue. Best of all, they were willing to let a newbie learn to chat. After a week or so practicing my social graces, I entered #hack, but there was just one last little hitch. We had agreed that any hint of entrapment was outside project parameters and because I was doing this for the DoD, I found myself on #hack with a .mil source address. Well, that brought back memories of elementary school and "Kick Me" signs taped to my back; kick me they did.

However, I won a TCP trivia challenge or two, and after a while, we managed to get things going. It was a lot of fun, and they couldn't resist attacking the .mil system, so we were able to collect a lot of fun data.

DTK

The Deception Tool Kit was authored by Fred Cohen and is available at http://all.net/dtk.

It is written in a combination of Perl and C and emulates a large number of services. DTK is a state machine, can emulate virtually any service, and comes ready to do so out of the box for a number of them. It used to be pretty easy to compile and set up. As it has been improved to be more realistic, however, it has started to become a bear to build.

This state machine approach is essentially what BackOfficer Friendly is, and as I write this Marcus Ranum is writing another honeypot for SANS students to try.

Empty System

Nothing looks more like UNIX than UNIX, or Windows NT than Windows NT. So in some sense, the perfect honeypot is just a system that is a little older and slower and has a smaller disk (the smaller the better, in case you loose the bubble). Then, you instrument the heck out of the system and collect information as folks try to exploit it. This has been taken to near science by the Honeynet team. Incidents.org is a member of the Honeynet alliance and has a vmware-, www.vmware.org, based Honeynet with a firewall, intrusion detection system, and a couple of running operating systems all running on a single machine.Vmware is the closest thing to magic I have ever seen. Lately, there have been some troubling indications that some of the honeypots and Honeynets on the Internet have been identified and their IP addresses are being passed around in the underground so that they avoid these systems.

Honeypot Summary

Honeypots are an advanced technique. They can be low yield for the effort one has to expend. On the other hand, if you block with your firewall or filtering router, you never get to collect the attack if you filter. A honeypot enables you to collect the attack. If you don't have a hot system, the best thing to do is set your honeypot up as either your DNS, web, or email relay system. These systems are routinely added to attackers' shopping lists. The good news is you can collect attacks; the bad news is you collect the same attacks over and over again.

Manual Response

Intrusion-detection analysts often serve a double role as lead for incident handling, or as a