... traffic. In the slide above, the packet is addressed to TCP port 143, the IMAP service. If the site does not allow IMAP through the firewall, then there will never be a SYN/ACK response, the TCP ... not sendmail and just changing the banner from “smap” to “sendmail” will not fool the wise attacker. The higher the fidelity of the honeypot, the greater the risk. Where do you put a honeypot? ... attack.That said, the main DTK is unlikely to be compromised and then the honeypot would be used to attack other people.5 - 2Information Risk Management - SANS ©20012Honeypots• What are they?•...