So you've successfully setup a honeypot. GREAT! Now what?! I've got all this amazing data but;

  • How do you analyze all the data collected from your honeypot software?
  • What should you be looking for? (IP addresses, Malware, IRC connections, 0days used, etc)

This is the 4th part of the "How to setup a honeypot" series;

  • 5
    I think you're approaching this backwards. What should you be looking for you should figure this out before setting up the honeypot in the first place; you should have a concrete purpose defined before deciding that a honeypot would be the ideal solution to... to... to what problem?
    – AviD
    Oct 14, 2012 at 8:15

1 Answer 1


So there are quite a few things you can do. Like AviD said you really need to know what your goal is with the honeypot before you even set it up.

  1. Watch behavior. Depending on the type of honeypot you have, you may see certain types of behavior that you can use to characterize the person attacking you. For example...If the attacker always sends 1 ICMP packet as if they ran the command ping -c 1 x.x.x.x. Or if you have a higher interaction honeypot, if they constantly run the ls command...quirks like that. If the attacker returns then you may be able to recognized him based off of these.

  2. Big organizations who deal with huge numbers of attacks (and successful attacks) will sometimes build honeypot networks that they put compromised computers into. They watch the attacker and figure out what they may be after, what their goals were, and who they might be. This may help you decide if changes need to be made to your security policy.

  3. If they are really crummy you may be able to figure out who they are (I've seen this happen often with botnets). Do with this information what you like...Build a court case or whatever you want...

If you were asking more of a technical How to sift through logs then you will need standard linux command line kung fu. Grep and awk are youre friends. Or you can use a tool to build a timeline like Zeitline or some other one.

Your course of action really depends on the data you collected. If there is IRC traffic then of course you want to investigate it. If you discover executables downloaded then you want to investigate that. Literally everything that is out of ordinary you want to investigate. tcprelay and security onion may be really really helpful in figuring what happened because it will help you create a timeline and see everything you asked about.

Hope I was helpful.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .