Chapter 14 – Honeypot Services on Linux
- Honeypots are deployed to catch attacker traffic "on film." Especially on internal networks, their primary goal is to keep the attacker engaged on the honeypot host for long enough that you can mount some defenses.
Lighting up an unexpected combination of ports on one host is a dead giveaway to your attacker that the target is a honeypot. Not only will they skip that host, but they'll proceed with additional caution, knowing that you have honeypots deployed.
- An AD domain controller typically has many of these ports enabled:
This list isn't complete and focuses on TCP ports. An attacker will often skip scanning UDP ports entirely, especially if the profile of open TCP ports is enough to identify target hosts.
On the internet, the exception will be scans for 500/udp and 4500/udp, which usually indicate open VPN endpoints.