I am aimed to study behaviour of honeypot attack on SSH server. Is there any simulation setup or tool to carry out this experiment?
Hi, it depends on the honey pot you are using. In general if you are on linux platform, you can analyse the server logs (secure.log, message.log) and the output of simple tool such as last and lastb. The annalysis is not difficult with some minor sh/bash or python scripting skills.
The is also possibility to capture all ssh traffic and store it in PCAP (tcpdump on linux) format for further analysis (Wireshark).
You may simulate Honeywall roo and sebek for capturing all activity of attacker with help of virtualziation.
If you are interested in traffic you could make port mirroring on switch. Trafic for switch port where you have connected server will be forward to mirror port. Here you can connect machine with sniffer software or any other monitoring tool. It all depend what you are looking, what data you want to collect. Mybee you can turn on SNMP and collect data from server there are many ways to collect data from network and machines.
You can use Kippo-Graph......it is a full featured script to visualize statistics from a Kippo SSH honeypot.
For more information see the following link
http://bruteforce.gr/kippo-graph
- Badges
- Science topic