Data Capture: How can I capture what the bad guy is doing?
A critical element to any honeypot is data capture, the ability to log, alert, and capture everything the bad guy is doing. Most honeypot solutions, such as Honeyd or Specter, have their own logging and alerting capabilities. However, you may want additional data capturing mechanisms to enhance the capabilities of these honeypots. Also, some solutions require you to deploy you own data capture capabilities, for example solutions such as Honeynets. I highly recommend you deploy Snort with any honeypot deployment. Snort is an OpenSource IDS system that will not only detect and alert any attacks against your honeypot, but it can capture the packets and packet payloads involved in the attack. This information can prove critical in analyzing the attackers activities. If you require more advance data capture capabilities (such as with SSH sessions), I recommend you check out the Honeynet Tools Page for a complete listing of different tools used to capture what the bad guys are doing.
