Honeyd for Windows

Honeypots are gaining momentum as a useful security tool alongside firewalls, Intrusion Detection Systems (IDSs), and antivirus software. Intended for the early detection of unauthorized activity, honeypots are computer assets that you intentionally configure to be vulnerable to compromise. A honeypot can be a computer, router, printer, or practically any networked device that has value to a potential intruder.

A properly configured honeypot doesn't contain any legitimate production software or data; its most distinguishing feature is that you can deem all activity that occurs on it as suspicious. This functionality is wholly unlike that of firewalls and IDSs, which are ruled by false-positive alerts. More than a dozen honeypot solutions are available, but only recently has the most popular open-source honeypot—Honeyd—become available for Windows. (See the Honeypots Solutions Web site at http://www.tracking-hackers.com/solutions for a listing of commercial and open-source solutions.) Let's look at honeypots in general, then discuss the configuration and deployment of Honeyd for Windows. . . .