[Snort-users] RE: VERY simple 'virtual' honeypot

Davis Ray Sickmon, Jr midryder at ...5013...
Fri Mar 8 12:43:08 EST 2002


I agree with the point of view that Snort is an IDS, and that's all it
should be.  While a product may tie with the output of snort to handle
something like this, anything acting as part of a honeypot should not be
directly a part of Snort, IMOSHO.  Snort is a great IDS, and should remain a
great IDS.  Rolling something else into Snort starts turning into a Jack Of
All Trades - which becomes more complex, more error prone, and harder to
maintain.

Having said that, I'm all for a really slick system for honeypots - just
built off of something else :-)

Davis Ray Sickmon, Jr
Owner, Midnight Ryder Technologies
http://www.midnightryder.com
(Or at least that's who I am right now...)

----- Original Message -----
From: "Ashley Thomas" <athomas at ...3539...>
To: "Alex Collins" <ALEX.COLLINS at ...5243...>
Cc: "'Kurt Seifried'" <bugtraq at ...5234...>; "Lance Spitzner"
<lance at ...2024...>; "Snort-Users (E-mail)"
<snort-users at lists.sourceforge.net>; <honeypots at ...35...>
Sent: Friday, March 08, 2002 1:19 PM
Subject: Re: [Snort-users] RE: VERY simple 'virtual' honeypot


>
> Do you think it is a good idea for an IDS to send out packets
> (the fake packets)
> I would think that it is best if the IDS remains in the stealth mode
> without doing anything "active"
>
> Pls correct me if i am wrong.
>
> -ashley
>






More information about the Snort-users mailing list