Re: logging facility

["Peter Bates" <Peter.Bates () lshtm ac uk>]

Hello all...

> <Motayyam79 () aol com> 28/08/03 01:19:09 >>>
> Fine, but an IDS can be deployed on a network that doesn't have any 
> production traffic.  
> What logging facilities does a honeypot use that makes it more stronger 
> than normal systems? 

As others have mentioned, part of the 'unique selling points' of honeypots are that you can monitor down to the system 
level itself, possibly using things like UML/VMware, or solutions like Sebek.

An IDS, even on a network with no production traffic (and hence a reduction in the amount of 'traffic' you have to 
analyze) will still not necessarily capture key strokes from a compromised SSH server, or IRC over SSL... you'll see 
'traffic', but not get the added benefit of being able to potentially see things from the 'outside in'.

...


--------------------------------------------------------------------------------------------------->
Peter Bates, Systems Support Officer, Network Support Team.
London School of Hygiene & Tropical Medicine.
Telephone:0207-958 8353 / Fax: 0207- 636 9838