Honeyd Implementation

ICMP handler very simple.
Replies to ICMP Echo Requests only unless Xprobe2 configuration is available.

UDP handler knows closed and open states.
Closed port generates ICMP Port Unreachable message.

TCP handler more complicated.
Requires complete TCP state machine.
State machines tries to be as correct as possible.
Initially, ports may be in LISTEN or CLOSED state.

LISTEN state causes 3WHS and all other required TCP states.
Connection 4-tuple stored in a Splay tree.
CLOSED state causes a TCP Reset to be sent.