Honeypot Design

Reminded me of the first honeynet I set up, during my second college degree (late 90s), in a lab where access to the internet was via individual machines direct connected public IPs (no firewalls at the time, just routers). I wasn't sure how many machines I could have available in the lab, unused, for each to run a honeypot of sorts (at the time I was interested in Usenet "spam"), so I took over the DHCP scope of the lab LAN, and hoped I could catch and use machines, as they were going for renewal, upon reboots / shutdown-power-up, especially as I did this on a Friday (you know the rule of Friday changes ;)). Got a call in the middle of the night, from a friend who had some work to do, letting me know that no machine in the lab was usable, and if I knew anything about. I obviously denied any knowledge, as I wanted my results from a 2.5 days run. Can't describe the joy of my professor, Monday morning, when the entire lab had to be "cleaned up", machine by machine, with each drive filled with spam over the weekend... O, tempora!

BTW - Lance Spitzner was one of my favorites at SANS, where I got a few certs in the (very) early 2000s.

I think there might be 7 and maybe 8 too.