Can honeypots monitor unused IP space?
Most definitely. We mentioned that one of the disadvantages of honeypots is that they capture traffic only interacting directly to them. To increase the odds of that happening, some honeypots work by monitoring all of your unused IP space. If anyone (or anything) attempts to interact with an IP address that does not have a computer assigned to it, some honeypots can dynamically take over that IP address, assume the identity of the victim, and then interact with the attacker. Two such examples are LaBrea Tarpit and Honeyd. Both work on the concept of ARP spoofing.
