Honeypots: Re: Honeypots: Uses and Features

[Cedric Foll <cedric.foll () ac-rouen fr>]

> I think this can be extended a little (unless this somehow warrents a
> category of its own).  I have seen people deploy honeypots not to
> learn or detect anything, but purely to lure the would be attacker
> away from the real network, with what would appear to be an easier
> target.  I'm not so sure this is the best use, but I figured it
> warrented mentioning none the less :)
I do something like that.
I have few honey pot in front of my FW.
So they seem to be easy targets (no protection, response to ping) but
with an IDS on them.
When we are under attack they are touch in first. So we can cfg our FW
to reject bad IP, contact administrator's IP and our CERT before big pb
come.