Honeyd vs TANNER

Honeyd is a self-hosted daemon for creating virtual network hosts and honeypots for threat detection, assessment, network simulation and monitoring. One host can claim as many as 65,536 IP addresses, while Honeyd can simulate thousands of virtual hosts at once. Simulated hosts can provide services defined in configuration files or proxy services to another machine. Honeyd can adapt TCP/IP behavior to imitate operating system personalities that Nmap or Xprobe can identify. Its virtual routing topologies can include configurable latency, packet loss, asymmetric routes, physical hosts and GRE tunnels. A flow logging option records connections and packets, including protocol and connection details and passive OS identification comments. Honeyd does not direct traffic to itself automatically; users need to route traffic to it using routing, proxy ARP or arpd. The project documents Nmap and Xprobe fingerprinting, GRE tunneling, and dependencies on libevent, libdnet and libpcap. Honeyd is free under the GNU General Public License. Its download information describes *BSD, GNU/Linux and Solaris support, while the FAQ describes a Windows port of version 0.5. The latest listed release is Honeyd 1.5c, dated 2007-05-27.

TANNER has no write-up on Specifiction yet; its figures are above.