Re: RE: VERY simple 'virtual' honeypot

["Davis Ray Sickmon, Jr" <midryder () midnightryder com>]

I agree with the point of view that Snort is an IDS, and that's all it
should be.  While a product may tie with the output of snort to handle
something like this, anything acting as part of a honeypot should not be
directly a part of Snort, IMOSHO.  Snort is a great IDS, and should remain a
great IDS.  Rolling something else into Snort starts turning into a Jack Of
All Trades - which becomes more complex, more error prone, and harder to
maintain.

Having said that, I'm all for a really slick system for honeypots - just
built off of something else :-)

Davis Ray Sickmon, Jr
Owner, Midnight Ryder Technologies
http://www.midnightryder.com
(Or at least that's who I am right now...)

----- Original Message -----
From: "Ashley Thomas" <athomas () unity ncsu edu>
To: "Alex Collins" <ALEX.COLLINS () INNOGY COM>
Cc: "'Kurt Seifried'" <bugtraq () seifried org>; "Lance Spitzner"
<lance () honeynet org>; "Snort-Users (E-mail)"
<snort-users () lists sourceforge net>; <honeypots () securityfocus com>
Sent: Friday, March 08, 2002 1:19 PM
Subject: Re: [Snort-users] RE: VERY simple 'virtual' honeypot


> Do you think it is a good idea for an IDS to send out packets
> (the fake packets)
> I would think that it is best if the IDS remains in the stealth mode
> without doing anything "active"
>
> Pls correct me if i am wrong.
>
> -ashley



_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users