4.9. Summary

This chapter introduced Honeyd, a framework for creating low-interaction honeypots that can listen to thousands of IP addresses. Your network needs to be configured so the machine on which Honeyd runs receives all necessary traffic. This can be achieved by configuring a router or Proxy ARP or by configuring Honeyd with MAC addresses itself. As Honeyd is a very complex application, we provided an example on how to install it and create basic configurations. The behavior of a single virtual honeypot is governed by a template. A template can be configured with services and bound to multiple IP addresses. With the information you learned in this chapter, you can configure Honeyd for many different scenarios. In next chapter, we are going to discuss some of Honeyd's more advanced features.