![](bg2.png)
and anomaly detection. Honeypots attacks and de-
tection techniques have also been studied. For in-
stance, Dornseif et al. (Dornseif et al., 2004) have
proposed an approach for attacking a honeynet lo-
cally. Krawetz (Krawetz, 2004) proposed a commer-
cial anti-honeypot spamming tool: ”Send-Safe’s Hon-
eypot Hunter”. The later attempts to detect ”safe”
proxies for use with bulk-mailing tools. Xinwen (Fu
et al., 2006) proposed a new technique that allows an
attacker to remotely fingerprint Honeyd by measuring
the latency of the network links emulated by Honeyd.
The reminder of this paper is structured as fol-
lows: section 2 gives an overview about Honeyd tech-
nology, section 3 describes our experimentations and
the discovered flows in the honeyd technology, sec-
tion 4 proposes some solutions for fixing the discov-
ered flaws. Finally, we provide in section 5 our con-
clusion.
2 HONEYD OVERVIEW
Honeyd is a popular open source low interaction hon-
eypot that runs on BSD, Linux and Solaris, although
recently ported to Windows. It offers a simple way to
emulate services offered by several machines on a sin-
gle one. The primary purpose of Honeyd is detection,
specifically to detect unauthorized activities within
your organization. It does this by monitoring all the
unused IP addresses in the network. Any attempt
connection to an unused IP address is assumed to be
unauthorized or malicious activity, so it generates an
alert. Recently, honeyd has been used for many pur-
poses. For exemple, it is used to detect,to analyze, and
to respond to attacks against organization networked
assets, regardless of where those threats come from.
Honeyd is generally used in conjunction with another
freely available utility called arpd (Song and Provos,
2003) that allows a single host to monitor multiple ad-
dresses on a network by responding to ARP requests
for unclaimed IP addresses.
Honeyd’s architecture consists of several compo-
nents: a configuration database, a central packet dis-
patcher, a protocol handlers, a personality engine, and
an optional routing component. The configuration
database is a sequence of templates, where each one
of them represents a system to be emulated. Inside
every template, we find the personality of a system,
its uptime, its UserID, its GroupID, the state of its
ports, and the IP address associated to it. The central
packet dispatcher is used to put the outgoing packets
in TCP/IP packets, and analyze the received TCP/IP
packets according to the associated fingerprint. The
personality engine is used by Honeyd for referring to
the network stack behavior of a virtual honeypot. The
daemon uses the Nmap fingerprint list as a reference.
The configured services are script sets. Each script
emulates a service of a real system. When the Honeyd
daemon receives a packet for one of the virtual hon-
eypots, it is processed by a central packet dispatcher.
The dispatcher checks the length of the IP packet and
verifies its checksum and then, it queries the configu-
ration database of a honeypot configuration that corre-
sponds to the destination IP address. If no such con-
figuration exists, the default template is used. Then
the dispatcher calls the protocol specific handler with
the received packet and the corresponding honeypot
configuration. For ICMP, it answers with an ICMP
ECHO reply packet. For TCP and UDP, the daemon
can establish connections to arbitrary services that re-
ceive data on standard input system and send their
output to standard output system. For more details,
see (Provos, 2003).
3 HONEYD ANALYSIS
To make the distinction between the physical ma-
chines and the various virtual ones which are cre-
ated by honeyd, we classified them in three different
classes:
• Class 1: class of real physical machines,
• Class 2: class of virtual machines created by hon-
eyd corresponding to templates which are differ-
ent from the default one defined in the configu-
ration file. In this class, the number of virtual
machines and their IP addresses are fixed in the
configuration file.
• Class 3: class of virtual machines created by hon-
eyd corresponding to the default template defined
in the configuration file. In this class, the number
of virtual machines is dynamic and their addresses
are based upon on the free addresses in the physi-
cal network.
Throughout this paper we will try to compare the ma-
chine behaviors of the last two classes with those of
the first class, by trying to highlight some abnormal
behaviors. These can lead to the detection of the hon-
eyd technology.
In order to show the flaws of the honeyd tech-
nology that allows an attacker to easily identify the
presence and scope of a deployed honeypot, we con-
ducted the following experiment. We used Honeyd
to setup three other virtual machines (honeypots) on
the local area network of our university. The first
honeypot is a Linux Suse 8.0, the second honey-
pot is a Windows XP Professional SP1 Microsoft,
SECRYPT 2008 - International Conference on Security and Cryptography
66