Introduction Internet-wide exploitation of vulnerabilities happens frequently: Automatic exploitation via worms. Scripted exploitation to create Zombies for DDoS attacks. Detecting new attacks and threats important: Early warning of new attacks. Security is an iterative process. As attackers get better, systems need to increase their security. Learning by observing and analyzing attackers. Honeypots are virtual doll houses that permit detection and research of new attack methods.