The simplest honeypot we will start with is a TCP honeypot. This will log any TCP connection received and any data received from the client.
It will respond with an authentication failure message. Since it logs any data received from the client, it will log any username and passwords they attempt to authenticate with. You can learn about their attack methods by inspecting what authentication methods they are attempting, since it acts like a black box and does not give any clues as to what authentication mechanism it might use. You can use the logs to see if they are treating it like an SMTP server, which may indicate a spammer, or maybe they are trying to authenticate with a database indicating they are looking for information. ...
