Forum Discussion
AltocumulusCan I use F5 Big-IP WAF as HoneyPot
MVPHi RockBD,
the answer is - it depends.
You cannot create a high interaction honeypot with ASM or with iRules.
With iRules you could do something like - if URL is /admin-login respond with a dummy form page.
Or an iRule that just responds 200 OK to everything and logs all requests.
In general, I see a honeypot more as something you would do with iRules rather then with ASM or LTM.
With ASM you could use anomaly detection to redirect suspicious traffic to a honeypot server.
Or, with the help of iRules, based on violations, you could redirect clients to a honeypot server.
Or, again with iRules, you could setup fake URLs and redirect them to a honeypot server.
This github list a lot of honeypot systems: https://github.com/paralax/awesome-honeypots
Cheers
Daniel
- Nikoolayy1
I agree with this answer. Also see https://my.f5.com/manage/s/article/K42323285 and https://my.f5.com/manage/s/article/K18650749 but F5 even when sending a page that looks like real server response is not meant to be full honeypod.
