Honeypot System Placement

skip navigation

honeypots for windows
Chapter 2 - A Honeypot Deployment Plan
Honeypots for Windows
by Roger A. Grimes
Apress 2005
progress indicator progress indicatorprogress indicator progress indicator

There are three main locations to place your honeypot system:

  • External facing the Internet

  • Internal behind the firewall

  • On the DMZ

Honeypot placement is usually discussed in its relationship to the perimeter-protecting firewall. Each location has its advantages and disadvantages, depending on your honeypot goals.

External Placement

If you want to get the most malicious hacks for your dollar, place your honeypot outside your network perimeter. It is not uncommon to see honeypots connected directly to the Internet, where they can be freely compromised and probed, as shown in Figure 2-9. This is the easiest setup for single personal, home-based and research honeypots.

image from book
Figure 2-9: External placement of a honeypot

With external placement, there is no firewall in front of the honeypot. The honeypot and production network share the same public IP address subnet. You will need one or more public IP addresses. If you have only one public IP address and you are working with a hub, you can give the public IP address to the honeypot and set up the monitoring station without an IP address.

In promiscuous mode with a non-Windows IP stack, the management workstation should be able to capture traffic headed to and from the honeypot. If you have a managed switch, set up the monitoring workstation in port mirroring mode. The use of a switch offers some protection over a hub, but without a firewall or some other sort of defense, this type of honeynet represents the largest risk to the production network.

The lack of a secondary router, firewall, or some other inline device means you’ve effectively made data control very difficult. Many people start out with this method because it is the easiest to set up. They have good intentions: they plan to plug in the honeypot only while they are actively monitoring it, or they create some sort of alert system that will page them when the honeypot is compromised. In either case, they intend to physically watch the hacker’s activity, and then pull the honeypot off the network if the hacker begins to attack other targets. This sounds great, but the devil is in the details.

If you plug in your honeypot only while you are actively watching it, you effectively limit its exposure. You’ll probably see some worm attacks in progress, but being right at the honeypot during an interesting manual hack attack session is more miss than hit.

If you’re using the alert method, what happens if you’re traveling in another city or at the doctor’s office when the honeypot is compromised? In the time it takes you to travel from where you are to the honeypot, the hacker could have used it to compromise other hosts. Data control is not very sexy, but lack of it is the highest legal risk to a honeypot administrator.

Internal Placement

Another common honeypot system location is inside the network, with the firewall between it and the outside world, as shown in Figure 2-10. This placement is the best way to create an early-warning system to alert you to any external exploits that have made it past your other network defenses and catch internal threats at the same time. For example, during the Blaster worm attacks, any companies that had their firewall configured to block port 135 were essentially safe from the worm. But the worm was able to sneak past the firewall on trusted VPN links and infected mobile laptop computers. Once past the firewall, the worm was able to infect unpatched internal machines. A honeypot would at least be an early-warning system that the worm had made it past the firewall.

image from book
Figure 2-10: Internal honeypot placement

On the downside, if an internal honeypot is compromised, data control within the local network is difficult. A hacker or worm could use the exploited honeypot to look for additional internal hosts to compromise. You can minimize that threat by placing yet another firewall (or other inline mechanism) on the honeypot/honeynet to limit outgoing activity, or use a low-interaction honeypot.

Because the honeypot system is placed behind the firewall, administrators will need to decide what Internet traffic is directed to the honeypot versus production assets. Will they allow any port traffic to the honeypot, or just redirect specific ports? For example, if the production network does not have a web server, the honeypot administrator might redirect any incoming HTTP requests to the honeypot instead. Or if a RPC worm is loose, any incoming probes to port 135 can be redirected to a tarpit. The use of the tarpit (as described in Chapter 1) slows down the worm’s progress and benefits the local network and the Internet. It is important to decide which ports you will allow past your firewall and where the traffic should head.

In this scenario, utilizing a port mirroring switch will decrease the chance that a hacker would detect your monitoring efforts. Note that the logging computer does not need a second network interface card, because the honeynet and the production network are one and the same.

DMZ Placement

Placing a honeypot on the firewall DMZ, as shown in Figure 2-11, is often the best choice for a company. It can be placed alongside your other legitimate DMZ servers and provide early warning of threats located there. A router is placed between the firewall’s DMZ as an added layer for data control. The honeynet and production DMZ servers share the same logical subnet and IP address scheme. The DMZ can have public or private IP addresses. The IDS/packet capturing computer uses the switch’s port mirroring abilities in order to remain hidden.

image from book
Figure 2-11: Honeypot DMZ placement

The placement of the honeynet within the DMZ is an ideal location for many entities, but it’s also the most complex placement model. Additionally, because it is located on the DMZ, it is not the best early-warning indicator for an internal network compromise.

Honeypot Placement Summary

Where you place your honeypot system depends on your objectives. Most administrators place honeypots externally or on the DMZ, but installing them internally as an early-warning system to back up other network security defenses is becoming more popular. Table 2-1 summarizes the advantages and disadvantages of each honeypot system location.

Table 2-1: Honeypot Placement Location Comparison





High Internet exposure

Easiest to set up

Low number of network devices needed

Poor data control

Highest risk to production network


Good for mimicking production assets

Best for monitoring internal employees

Early-warning system to back up other defenses

More complex setup

Data control questionable

Need to decide which ports to allow/redirect


Good for mimicking production assets

Good data control possible

Most complex setup

Not the strongest internal early-warning system

Need to decide which ports to allow/redirect

progress indicator progress indicatorprogress indicator progress indicator

Honeypots for Windows
Honeypots for Windows (Books for Professionals by Professionals)
ISBN: 1590593359
EAN: 2147483647
Year: 2006
Pages: 119

Similar book on Amazon
Honeypots: Tracking Hackers
Honeypots: Tracking Hackers
Know Your Enemy: Learning about Security Threats (2nd Edition)
Know Your Enemy: Learning about Security Threats (2nd Edition)
Virtual Honeypots: From Botnet Tracking to Intrusion Detection
Virtual Honeypots: From Botnet Tracking to Intrusion Detection
Malware Analyst's Cookbook and DVD: Tools and Techniques for Fighting Malicious Code
Malware Analyst's Cookbook and DVD: Tools and Techniques for Fighting Malicious Code

flylib.com © 2008-2017.
If you may any questions please contact us: flylib@qtcs.net