Honeyd Detection via Packet Fragmentation

In this paper we describe a serious flaw in a popular honeypot software suite that allows an attacker to easily identify the presence and scope of a deployed honeypot. We describe in detail both the flaw and how it can be used by an attacker. Our technique relies on a set of specially crafted packets which are able to elicit a response from a Honeyd-based honeypot. Simple experiments show that this method is extremely accurate and effective in detecting the presence and the scope of a Honeyd deployment. Moreover, due to the low level of effort and bandwidth required, it is possible to perform honeypot reconnaissance easily prior to launching a malicious attack on a network, even for large address spaces. We also discuss a simple fix for this flaw as well as other factors that can affect the effectiveness of our approach.