What is a honeynet?
A honeynet is a set of decoy systems, two or more honeypots, connected so they look like a real network segment. A typical one contains a fake domain controller, a file server, a database and a few workstations, all with believable names, users and fake data. Nobody legitimate works on it, so every connection inside it comes from an attacker or a misconfigured system. A single honeypot shows what an intruder does to one machine; a honeynet shows how they move from one machine to the next.
How a honeynet is built
- Decoy hosts: usually high-interaction systems running real operating systems, so intruders can log in, run tools and try to escalate privileges.
- Isolation: a segment of its own, never joined to the production domain and holding no real credentials or data.
- A controlling gateway: often called a honeywall, it captures all traffic and throttles or blocks outbound connections so a compromised decoy can't be used against anyone else.
- Data capture: packet capture, host logs and session recording sent to a collector the attacker can't reach or tamper with.
What defenders learn from one
A honeynet trades effort and risk for depth. Analysts can watch which credentials an intruder tries first, how they discover other hosts, which lateral movement methods they favor, what malware they drop and where it calls home. That output feeds threat intelligence, detection rules and indicators of compromise for the real network. Researchers and security vendors run internet-facing honeynets mainly for this insight. Inside an enterprise, a smaller honeynet beside sensitive segments also works as a high-confidence alarm, since no business traffic should ever reach it.
Risks and upkeep
A honeynet is the riskiest decoy to run. Real systems that get compromised can become a launch point for attacks, spam or malware hosting, and the owner may be held responsible for the harm. Outbound filtering at the gateway is the main safeguard. Honeynets also take work to keep believable: patch levels, logon activity, file dates and traffic that never change give them away to a careful intruder. Get legal review before capturing attacker communications, because monitoring and interception rules differ by jurisdiction.
Honeynet vs. honeypot and sandbox
- Honeypot: one decoy system.
- Honeynet: several decoys networked together to observe movement between them.
- Sandbox: an isolated environment for detonating a file you already have; it doesn't wait for an attacker to arrive.
Honeynet on the CompTIA Security+ exam
Honeynets are deception and disruption technology under SY0-801 objective 4.1, which covers choosing mitigating controls. Wording such as a network of decoy systems, a fake segment that mimics production, or observing how attackers move between machines points to a honeynet. If the scenario describes a single decoy server, choose honeypot; if the bait is a document, a piece of data or a directory account, look for honeyfile, honeytoken or canary account. Like the other decoys, a honeynet detects and studies attackers, so it isn't the answer when a question asks how to prevent an attack.