Re: Know Your Enemy: GenII Honeynets

[Mike Clark <mike () honeynet org>]

> choose an arbitrary port to have things report on such as 30519 or
> something, and have the logging facility listen for that port, while on the
> honeypot itself all other traffic such as their SSH/IRC/etc connections
> would still be visible.


Well,  you never know what port an attacker will use as a backdoor.  Small
chance itd be the specified port, but it could be.  As George mentioned,
it does not hide based on the honeypots mac, which should address much of
your concerns :)

As for the paper, while gen 2 technology is "old"  it still should be
documented.  And now it is :)

Mike Clark