When I started reading about honeypots, I could understand what is honeypot, how it works theoretically, i.e it is a trap-network that may or may not mimics a real network, but because of my limited thinking, what I could not get is, how exactly are they setup technically for any given network.
For example I have an ICS network that involves MTUs (Master Terminal Unit) and several RTUs (Remote Terminal Units) which read remote field parameters (sensors) and sends to an MTU over public network.
- How honey pots are setup technically for any typical internet service, in terms of mimicking the service, IP address used by the service?
- How can I set up a honeypot for an ICS network such as one mentioned in the above example?
- How will attackers find my honeypot network (thinking as a vulnerable network)? Should I advertise my network in any way?
- What makes them attack my trap network rather than the actual legitimate network?