a system designed to lure attackers towards it in order to learn about new attacks or to draw attention away from the real system

learn more… | top users | synonyms

-1
votes
1answer
228 views

How to detect a Dionaea Honeypot, is it possible or not?

There is a question like this but the answers aren't sufficient to me. I am interested in a honeypot project and I use the dionaea honeypot. This project is really cool, but there is a problem. How ...
6
votes
0answers
81 views

How to understand QEBEK (Honeypot Monitoring Tool)?

I am working from a while to find something meaningful or updated about QEBEK, but what i got is here in two links Intro and KYT Paper for Installation 2010 . These links are nothing more that a ...
1
vote
0answers
20 views

Honeypot Configuration - Alerting with Mandrill

Has anyone connected the OpenCanary Honeypot Correlator to Mandrill? There is a section of the opencanary_correlator.conf file that allows for the Mandrill API key but for no other configuration. How ...
1
vote
0answers
34 views

PGP 'forced entry' decode (steganography?)

This was originally posted by me on stackoverflow but was deemed too generic. It does seem like an impossible thing to do, but: you know when you have your perimeter alarm system you usually get ...
1
vote
0answers
49 views

problem blocking TCP scans by setting up honeyd in virtual environment

I am creating a virtual environment where I have created three virtual machines, CentOS as an Apache Webserver CentOs as an Attacker machine FreeBSD with Honeyd to setup Honeypot I have ...
1
vote
0answers
129 views

Anyone seen weird messages in their logs?

I've been reading over the logs on my honeypot and discovered the following messages that seem to be either gibberish or a cypher message: kernel: v0 neigfradn tt kernel: [2108296.63083] devc nt nee ...
1
vote
0answers
105 views

Suppressing broadcast traffic in honeyd logs?

I'm trying to set up a honeyd system. How can I suppress the broadcast traffic seen by the outside interface, preferably without needing to resort to syslog filters? User subnet 192.168.20.0/24, ...
0
votes
0answers
48 views

I can't get the honeyd to run in loopback interface

I've been working on honeyd for two day and am struggling with it. What I'd like to do is that I'd want to run it on my own localhost (i.e. loopback interface). But I'm keep getting the following ...
0
votes
0answers
80 views

Script to emulate DNS for Windows machine in honeyd

I want to simulate virtual Windows hosts using honeyd. To do so I have installed honeyd. I have configured honeyd as Windows XP SP1, and now I want to emulate DNS services on it. I used UDPot as a DNS ...
-1
votes
0answers
25 views

Explanation for these entries in the Suricata fast.log?

We have installed Suricata on our system. We have the following similar lines in our fast.log. Can anyone explain these lines? 03/17/2016-17:18:52.744707 [**] [1:2200075:1] SURICATA UDPv4 invalid ...