Re: [tlug] Honeypots

[Uva Coder <uvacoder@example.com>]

On Thu, Mar 07, 2002 at 10:07:14AM +0800, Mancy, Raymond wrote:
> I was wondering if anybody has made one of these before? What OS are you
> running and what services? I know that there are arguments for and against
> them, but it seems like an interesting idea nonetheless. Thats if you have
> the time and the resources....

The honeypots that I've dealt with were running on WinNT 
with basic services such as IIS, Exchange, pop3 and DNS.

The machine at work which monitored the honeypots was
a Linux box running a proprietary network IDS program.

Activity logs from the screening router, firewall, IDS
machine and honeypots were compiled, analyzed, compared,
archived and then sent to a third party site for further
analysis. 

On a lighter note, it could be argued that our previous
TLUG server "Nozomi" was a honeypot. :)

-- Uva