Virtual Subsystems Subsystems are real UNIX applications. web server, ftp server, p2p application. Shared library preloading to redirect network calls to Honeyd. Honeyd virtualizes subsystem processes: Network connections originate from virtual IP address. Port binding in virtual name space. Performance improvement as no fork per connection is required. Subsystems can initiate network connections. Background activity. More complicated protocols like FTP supported.