Honeyd: log grows too fast

Question

I'm having trouble with honeyd log; it grows way too fast. I started the honeyd daemon with

honeyd -l /var/log/honeypot/honey.log -u 1000 -g 1000 -f honeyd.conf

/var/log/honeypot/honey.log is 1+ GiB log after ~4 hours.

I'm using the following honeyd.conf file:

create default
set default default tcp action block
set default default udp action block
set default default icmp action block

create windows
set windows personality "Microsoft Windows XP Professional SP1"
set windows default tcp action reset
add windows tcp port 22 "scripts/test.sh" 
add windows tcp port 135 proxy $ipsrc:135 
add windows tcp port 137 proxy $ipsrc:137
add windows tcp port 138 proxy $ipsrc:138
add windows tcp port 139 proxy $ipsrc:139
add windows tcp port 445 proxy $ipsrc:445 
add windows tcp port 8008 "scripts/web.sh"
add windows udp port 137 proxy $ipsrc:137
add windows udp port 138 proxy $ipsrc:138
add windows udp port 445 proxy $ipsrc:445

set windows ethernet "realtek"
bind "192.168.1.6" windows

In the logs I can find that it's logging also all packets sent to 192.168.1.2, and 192.168.1.5, which are the other IPs in this Ethernet segment.

Is there any way I can filter what's being logged? I only want to log packets directed to the honeypot (192.168.1.6).

Thanks in advance.

Answer 1

Usually a large number of log entries from a honeypot are from one of two reasons:

1. Your environment is getting scanned like a smudged barcode.
2. You made the mistake of putting your honeypot on a non-dark network.

You've configured your honeypot as a pretty typical Windows desktop, so lots of Windows service active, open sharing, etc. What you are likely seeing is just how incredibly NOISY the NetBIOS protocol is. Windows is exceptionally chatty what with the file and print sharing discovery, Workgroup auto-configuration, and my personal favorite...Browser Elections.

Without actually seeing an analysis of your log files, I'm going to guess you're just being flooded by the honeypot reporting all of that Windows discovery nonsense. By and large honeypots are designed to sit on dark networks, that is a subnet in your address space that is otherwise unallocated. They assume that any traffic reaching the system is malicious, or at the very least invalid, and should be reported on.

Answer 2

you could use splunk connect to your honeyd and using it to grap key value you need. as for the log from honeyd just delete it using cron. As splunk has it own DB to get the log

I find it much better and simpler to analyse logs and can help you cut down the amount of data from honeyd

Answer 3

You can tell honeyd to filter by IP (log only communications from/to one specific IP) by changing the NETWORK setting in /etc/defaults/honeyd. In my case:

NETWORK=192.168.1.6