Re: sebek data

[Edward Balas <ebalas () iu edu>]

On Feb 4, 2004, at 6:40 AM, ansiry fsktm wrote:

> is sebek is the only one data capture tool in a
> honeynet? can the data captured by be used to do some
> analysis? is it enough?



1.  Sebek is just one of the many sources of data used in a honeynet.
        I would recommend you review the repository of papers at:

                http://project.honeynet.org/papers/index.html
        
        Further to get a sense of how things have evolved you may want to
        read these in chronological order.


2.  A number of data analysis tools are provided by the Honeynet 
Project.
        Information on these tools and the types of analysis that can easily
        be done today are located at:

                http://project.honeynet.org/papers/sebek.pdf

        Further the Sebek project page is located at:

                http://project.honeynet.org/tools/sebek/

3.  To answer your last question, I would have to have a sense of what 
you
        what to do.  However, as researchers we always want more ;-)