Re: Honeypots: Uses and Features

["Larissa Fricker" <lft () netsec ch>]

How important is logging every connection attempt on every
(closed) port for a production honeypot?

Because it multiplies the number of 'irrelevant' security incidents
and as a result also considerably increases the number of alerts,
I feel that it might cause more bad than good in a production
honeypot, where a low rate of false alerts is paramount.

I realize that the situation is completely different for research setups.

What do you think?

   Lara

--------------------------------------------------------------------
 N E T S E C - Network Security Software
 Web: www.netsec.ch  -  Mail: info () netsec ch
 Munzingerstr. 17A - 3007 Bern - Switzerland
 Phone: +41 313760534 - Fax: +41 313760533
--------------------------------------------------------------------