This command tells Honeyd to pass DNS traffic that arrives on UDP port 53 to an external DNS service that resides on a machine with the IP address of 68.10.16.30. An intruder might get suspicious if the compromised box won't let him or her do anything or get to any services. The more your honeypot resembles a real host, the longer the intruder will stay and the more useful forensics evidence you can collect.
In Honeyd, you can write and use script files to emulate services that sit on different ports. After you learn how to write emulated service scripts to interact with Honeyd, you can use a script engine that your host OS supports—or even compiled C or C++—to write custom emulation scripts. Most of the scripts available for Honeyd are written for the UNIX version in Perl and shell scripting. (You can find these common scripts on the Web.) Because most existing scripts for Honeyd are written in scripting languages that Windows doesn't install by default, you need to install a Perl or shell scripting engine. I should warn you that getting scripts to work and setting up emulated services on Honeyd is perhaps the most difficult step for a first-time user. But don't get frustrated—the journey is worth the payoff. . . .
Register
