Experiences with a Generation III virtual Honeynet

This paper proposes a methodology for establishing a virtual Honeynet on a VMware Server running Honeywall CDROM Roo. The implementation is specific to a Linux based host having a single physical network interface card. Security of virtual Honeynets is always a concern, special techniques are discussed in the paper to ensure their security and to mitigate associated risks posed to the host and virtual machines. An effort has been made to ensure that all the software (both the OS and associated tools) used for the project are either free or Open Source. Special techniques were implemented in order to enhance the data capture mechanisms on the Linux-based Honeypot to efficiently generate reports. Risk evaluation and suggestions for improvements to the methodology are proposed.