Re: logging facility

[Valdis.Kletnieks () vt edu]

On Wed, 27 Aug 2003 13:36:34 EDT, Motayyam79 () aol com  said:

> what makes the logging capability on honeypots far stronger than normal 
> systems like IDS?

First off, I'm not at all convinced that the logging capability *itself* is any stronger.
If it was, the IDS could just use the stronger capability itself.

The major benefit a honeypot has is that you have very few issues with false
positives - after all, a honeypot is basically just an IDS parked someplace
where it *shouldnt* see traffic, so all the traffic it gets is presumably from
people who are up to no good.  An IDS on a production system can be
a bad time if a specific Oracle query used by the payroll system happens to
false-positive a Snort rule (Yes, I've seen it happen - it wasn't pretty.. ;)

Attachment: _bin
Description: