Honeypots: Re: Advice for setting up honeynet at home

[Christian Kreibich <christian () whoop org>]

On Thu, 2004-05-06 at 09:59, Valdis.Kletnieks () vt edu wrote:
> Simple.  Don't bother filtering. Just connect your honeynet to your cable
> modem, and don't surf the net or download your e-mail.  Anything that comes
> across is probably a worm. :)
... or Windows popup spam :)

But Valdis is right -- what I would suggest is if you're running a
standard firewall setup that allows only outbound connection requests,
then instead of blocking incoming connection requests at the outside,
route them to your honeypot for logging/interaction.

Cheers,
Christian.
-- 
________________________________________________________________________
                                          http://www.cl.cam.ac.uk/~cpk25
                                                    http://www.whoop.org