Re: Does it really take so long to get a bite?

[Brian Hatch <honeypots () ifokr org>]

> And it got me thinking again of how it might depend upon the IP address.
> Would it not make sense to try to compare scans for the same service for
> various honeypots running on different IPs?  The question is how to make
> the comparison without disclosing the honeypot IP address?

That is a possibility.  But I think we've been failing to
list one crucial detail: OS.

My vulnerable '1.5-years-without-a-breakin' sparc machine was on a campus
network.  The x86 honeypot one ip address away was getting rooted routinely.

However the sparc was runing linux, not solaris.  Many x86 linux attacks
were thrown at it, but few sparc versions (and those were irrelevant to
what I'd installed.)

However I've no doubt that had it been running solaris, it would have
been pegged with more appropriate attacks.

--
Brian Hatch                  Reegen: "Mama knocked it over."
   Systems and                 Bree: "No I didn't, you
   Security Engineer                  suspicious wench."
http://www.ifokr.org/bri/     Brian: "Uhh, that's not in the
                                      parenting books..."
Every message PGP signed

Attachment: _bin
Description: