Honeyd Sample Configurations

Some configurations that outline features available in Honeyd. We show how to instrument different kind of honeypots.

Wireless Honeypot

This configuration sets up a fake Internet routing topology. Every host on the network is reachable. We provide a web server, a pop server and a ssh server. Both the pop and the ssh server can be used to capture passwords or inject spam email.


Unreachable networks

route unreach

Whenever a packet traverses the router to reach network, Honeyd generates an ICMP network unreachable error message. This feature can be used to create more realistic network topologies.

Default template

create default
set default personality "Linux 2.2.14"
set default default tcp action block
add default udp port 53 "./scripts/dnstool.py"

The default template is used for every packet sent to a destination address that does not have its own template. We can use this to populate all addresses in a network with machines, but we can also use it to block all traffic that goes to a machine without its own template.

Lance Spitzner’s Honeyd Toolkit Configurations

These configuration shows how to build a sample network configuration step-by-step. It shows features like multiple entry points, GRE tunnels and integrates physical hosts into the virtual topology.


GRE Tunnel

route entry network
route link
route add net tunnel

This example allows Honeyd to send packets destined for the 10.3.1/24 network to be sent to the remote router You need to make sure that router is correctly configured to terminate the tunnel. Response packets are received GRE encapsulated by and inserted into the virtual routing topology.


create sticky
set sticky personality "Mac OS X 10.1 - 10.1.4"
set sticky default tcp action tarpit open set
sticky default udp action block bind sticky

This example shows a virtual honeypot simulating an insecure and open Mac OS X machine. The template is designed to tarpit (slow down) spammers, worms and autorooters. All ports are open and the tarpit option ensures that any communication is slowed down.

More feature explanation and configurations coming soon.