Yes, I am finally giving up my secret...

if any of you all remember my tricks from Last July...

[link|http://www.citi.umich.edu/u/provos/honeyd/|Honeyd]

Honeyd is a small daemon that creates virtual hosts on a network. The hosts can be configured to run arbitrary services, and their TCP personality can be adapted so that they appear to be running certain versions of operating systems.

And I was using VMWare on the machine as well to isolate things... as well... and a few other tools like [link|http://lin.fsid.cvut.cz/~kra/index.html|hunt], [link|http://knocker.sourceforge.net/|knocker](icmppush to respond the WAY I wanted it to), isic (can't find a homepage for it), a tcp-redirector I can't find at all now, and some hacks to the OpenBSD TCP stack, and using an OLD Adaptec 4 Port NIC (4 10/100 Ethernet Ports)...

Some of the IP Addy's if you even connected to the Address at the right port... you'd get a command prompt... sometimes you'd get a connection refusal the next time... maybe a burp of data back, or even an "obvious Ping of Death Attempt" or even a TTL expiry... kind of emulating a confused-panicky admin... ;)

So, now you guys know... It was Really fun seeing HOW many kiddies thought they'd hit a goldmine... or something...

Some of us had an interest... I sent most stuff to the Honeynet project...

Twas at my previous employ... so they are just about made of unobtainium... at this point.

LOTS of changes at GRCC, since I've left. Finally have VMWare ESX... and a New Firewall build... (hmm like they were scared of meor something, actually the Storage failed on it)

Some of the stuff was hilarious... was actually a combo of 2 machines... a P5-166 doing the dirty work of luring and a quad PP200 doing the hard work of isolation...

Some of the command lines read "You BASTARD!! This isn't a Windows Box!!" or one had a tremendously long tirade about how it was just wrong to lead one to believe 25plus exploit are sitting there for the taking... and then being something else...

There was another attempt to engineer exactly WHAT I was doing... probes and attack from about 400 ip addresses being coordinated to "pickup" what was being done...

We actually got an e-mail from one of those anonymous crackhosts... congratualting us ona good game... and wining once... to webmaster.

Ask me about sometime, I tell it better than typing it...