Intrusion detection honeypots simplify network security
Low-cost, low-fuss honeypots are highly effective early-warning systems against external attacks and insider threats; KFSensor, HoneyPoint, and Honeyd offer safety, ease, and flexibility
Columnist, InfoWorld |
Honeypots by the features: KFSensor, HoneyPoint, and Honeyd
| KFSensor | HoneyPoint | Honeyd | |
|---|---|---|---|
| Product version | KFSensor v.4.7.0 Professional | HoneyPoint Security Server 3.00 | Honeyd 1.5c |
| Built-in interaction level | Low to intermediate | Low, but more can be customized | Low, but more can be customized |
| Supported host OS | Windows only | Windows, Linux, Mac OS X | Linux, BSD, Solaris, Windows (problematic) |
| Install as service or daemon | Yes | Yes | Yes |
| Listen on all TCP and UDP ports | Yes | Yes | Yes |
| Denial of service prevention | Yes | No | No |
| Built-in IDS signature capabilities | Yes | No | No |
| Built-in emulated services | |||
| Network emulation | No | No | Yes |
| Emulate OS at network stack level | No | No | Yes |
| Emulate unrelated OSs | No | No | Yes |
| Web server | Yes | Yes | Yes |
| SQL | Yes | No | No |
| NetBIOS/SMB/CIFS | Yes | No | No |
| FTP | Yes | No | No |
| SMTP | Yes | Yes | No |
| POP3 | Yes | Yes | No |
| ICMP | Yes | No | Yes |
| Simulate open relay | Yes | No | No |
| Worm/trojan emulation | Yes | No | No |
| Supports external simulation scripts | Yes | Yes, basic | Yes |
| Forward probes to external servers/services | Yes | No | Yes |
| Store logs to databases | Yes | Yes, local SQL | Yes |
| Capture packet-level detail | Yes, with Winpcap installed | No | Yes, with libpcap installed |
| Supports plug-in extensions | No | Yes | Yes |
| Alert types | |||
| Displayed locally | Yes, plus status bar and audio | Yes, in console | Yes, in console |
| Yes | Yes | Not built-in, but can be done | |
| Email throttling | Yes | Yes | Not built-in, but can be done |
| Syslog | Yes | Yes | Yes |
| Windows Event logs | Yes | Yes | No |
| Central console | Yes | Yes | Not built-in, but can be done |
| External programs | Yes | No | Not built-in, but can be done |
| Logs exportable | Yes | Yes | Not built-in, but can be done |
| Severity/criticality ratings allowed | Yes | Yes | Yes |
| Reporting | |||
| Built-in reports | No | Yes | No |
| Reports customizable | N/A | Yes, using third-party SQL report tools | N/A |
| Pricing | KFSensor pricing starts at $199 for the Standard Edition and $599 for the Professional Edition; volume discounts available | HoneyPoint Security Server is licensed per sensor, includes one console; starter packages begin at $4,995 for 10 sensors | Free open source under the GNU General Public License |
Copyright © 2010 IDG Communications, Inc.