The honeynet arms race

In july 2003, the Honeynet Project released version 2 of its data-capture tool, Sebek. Several days later, the self-described blackhat group that calls itself the Phrack High Council released a counterfeit issue of the online hacker periodical Phrack Magazine. The issue included an article titled "Local Honeypot Identification" that criticized Sebek's effectiveness and that of honeynets in general. Although the means of distributing the fake issue were irregular and the article was littered with puerile humor and gratuitous inflammatory remarks, it did raise several significant issues worthy of discussion. This month's installment of the Honeynet Files describes Sebek and makes the case that despite the fake Phrack issue's claims, both Sebek and honeynets are useful to network security engineers and researchers.