Re: DNS honeypots?

On Tue, Mar 2, 2010 at 4:48 PM,  <[email protected]> wrote:
> On Tue, 02 Mar 2010 15:00:43 EST, Jason Lewis said:
>> Anyone have any pointers to dns honeypots or maybe just BIND
>> configurations that would allow logging of malicious queries without
>> actually executing them?
>
> Out of curiosity, how do you get traffic directed to the honeypot without
> listing it in an NS entry for an SOA? =C2=A0Give it a hostname like ns1.e=
xampe.com
> and hope that works?
>

There's quite a lot of (bad and good) bots "out there" looking for DNS
servers, particularly ones that appear to permit recursive queries to
the Internet. Just leaving a box on the net that meets those criteria
will collect a fair amount of queries.

--
jason