Ravi Sir's Cyber Security Cards › Revision Cards
Honeypots and Honeynets – Deception, Ethics, Alerts
Honeypots and Honeynets – Deception, Ethics, Alerts A honeypot is a fake system whose only purpose is to be touched by an intruder. A honeynet is a small fake network. Low-interaction (like Cowrie: a fake SSH shell that logs tried passwords). High-interaction (a real system, watched closely). Any to
Read card text
What this card says
What it is
A honeypot is a fake system whose only purpose is to be touched by an intruder.
A honeynet is a small fake network.
Types
Low-interaction (like Cowrie: a fake SSH shell that logs tried passwords).
High-interaction (a real system, watched closely).
Why it matters for security
Any touch on a honeypot is suspicious, so it gives high-quality alerts.
Keep it isolated and never use it to attack back.
| Red team (attacker) does | Blue team (defender)… |
|---|---|
| Banner-grabs then skips known honeypot fingerprints | Still alert on the grab; rotate banners; don't publish lab… |
| Uses honeypot as pivot if high-interaction is sloppy | VLAN isolate; no credentials to real AD; snapshot + revert |
| Brute-forces fake SSH (Cowrie) | Alert on first try; feed IPs to firewalld drop (with review) |
Learn more in the lesson: 42.6 Honeypots and Honeynets – Deception, Ethics, Alerts