I want to operate honeypots for malware analysis purpose and packet capture.

What honeypots are recommended for beginners ? And, what is the best to set-up an honeypot, should it be in a real machine or in a virtual machine ? Finally, does this technique really work for malware capture or is there a better way to get real malware ?


You should take a look at the honeynet project as it's probably the most well known implementation of a honey pot, and it includes plenty of tools and instructions to set up the honey pot and properly set up logging information. You can also see this thread as the accepted answer here provides a lot of detail and perspective about what you should think about when you're setting up a honeypot.

Any time you're doing any kind of analysis or interaction with malware you should be running it inside of a Virtual Machine. Security procedures aside you never know what you're going to run into when you're doing analysis.

That being said, there is plenty of malware that operates differently if it detects it's running inside of a virtual machine vs. a real system but if you're just getting started I would recommend doing your analysis inside of a VM.

Not the answer you're looking for? Browse other questions tagged or ask your own question.