Overview
An exposure probe is a "trap" deployed in your business system. It can be an IP address or a domain name, and it forwards traffic from specified ports/paths to a designated honeypot service to record attacker information and trace attack methods. A Network Honeypot service can run properly only after it is associated with an exposure probe. This document describes how to create and manage exposure probes.
Creating an Exposure Probe
1. Log in to the CFW console, and in the left sidebar, choose Network Honeypot > Probe Exposure. 2. On the Exposed Probes page, click Create Probe.
3. In the Create Exposure Probe dialog, select the region, instance name, deployment mode, and corresponding parameters, and then click Next.
|
Region | Supports some regions in the Chinese mainland. For specific regions, log in to the CFW console > Network Honeypot > Create Probe > Region to view them. The region cannot be changed after the instance is created. |
Instance name | Customize the instance name. |
Mode | Load balancer: Select an existing CLB instance to deploy the probe. Traffic from the path on the specified domain will be forwarded to the honeypot service. Public IP: Select an existing public IP address to deploy the probe. Traffic from the specified port on this IP address will be forwarded to the honeypot service. Private IP: Select a subnet. The system will automatically create an ENI and a private IP address. You can configure the specified port of this IP address to forward traffic to the honeypot service. |
Deploy instance | When the deployment mode is Load balancer, configure this item. Select a CLB instance in the same region as the honeypot. |
Domain name | When the deployment mode is Load balancer, configure this item. Specify a listener on the selected CLB instance. |
Select a subnet | When the deployment mode is Load balancer or Private IP, configure this item. Load balancer: Specify the subnet where the CLB backend servers (RSs) reside. The subnet list is filtered based on the VPC to which the selected CLB instance belongs. Private IP: Select a subnet, and the system will automatically create an ENI and a private IP address in the subnet. |
IP address | When the deployment mode is Load balancer or Private IP, configure this item. Load balancer: The private IP address used by the CLB backend RSs supports automatic allocation or manual entry. After successful creation, the firewall automatically registers this IP address as a CLB backend RS, and automatically deregisters it when the probe is deleted. Private IP: The private IP address of the ENI that is automatically assigned by the system. |
EIP | When the deployment mode is Public IP, configure this item. Select a new elastic IP address. |
4. Configure the forwarding honeypot service, and click OK to complete the creation.
Create honeypot with template: Select Create Honeypot or Create Honeynet. You can select multiple honeypots when creating honeypots. When creating a honeynet, select a preset template to generate a simulated network consisting of multiple honeypots and probes at once.
Note:
Because a WEB honeypot requires an existing SSH/MySQL honeypot as bait, a WEB honeypot is not automatically associated with bait after quick creation. When you create a WEB honeypot by using Quick Honeypot Creation, the honeypot service does not start working. You need to find the corresponding WEB honeypot in the honeypot service, edit it, and associate it with the corresponding SSH/MySQL honeypot. Only then does the honeypot service start working.
Select from existing: Select the desired honeypot service, and modify the listening port or input path as needed. The drop-down list also displays honeynet entry honeypots that are not bound to any probe (marked with the Honeynet tag). Selecting an entry honeypot selects the entire honeynet, and its listening port is automatically populated based on the entry honeypot type.
Note:
When the deployment mode is Public IP, you can modify the listening port.
Port opening type honeypot: Supports entering a single port or a port range separated by /, such as 80, 80/80, -1/-1, or 1/65535.
Interactive honeypot: Only a single port can be entered.
When the deployment mode is Load balancer, some honeypots support custom paths. For details, refer to the console.
Set later: Do not bind a honeypot service, and click OK. You can bind it later when editing the probe.
5. You can enable probes individually or in batches.
Single: Select the target probe, click the switch icon in the switch column, and click OK in the confirmation dialog to enable a single probe.
Batch: Select one or more probes, click Enable Probe, and click OK in the confirmation dialog to enable multiple probes.
Managing Exposure Probes
Editing Configuration
1. On the Exposed Probes page, select the target probe and click Edit in the operation column. 2. In the Edit Probe Exposure dialog, you can modify the instance name and the probe port/path forwarded to the honeypot service. Click OK to save the changes.
Note:
For existing probes with the deployment mode set to Load balancer (the original forwarder solution), the original forwarder configuration (including forwarder CVM information) is still displayed during editing, and migration to the new solution is not supported.
For newly created probes with the deployment mode set to Load balancer (the private IP address direct connection solution), the subnet and private IP address fields are displayed during editing, and the private IP address can be modified. Probes within a honeynet cannot be edited individually, and their configurations are managed centrally by the honeynet.
Deleting Probes
On the Exposed Probes page, you can delete probes individually or in batches: Single: Select the target probe, click Delete in the operation column, and click OK in the deletion confirmation dialog to delete a single probe.
Batch: Select one or more probes, click Delete, and click OK in the deletion confirmation dialog to delete the selected probes.
Note:
After you delete a CLB probe, the system automatically removes the private IP address associated with the probe from the CLB backend RS list, without manual intervention. Deleting any member probe in a honeynet is a high-risk operation. The system cascades the deletion to all probes and honeypots in the honeynet, which cannot be undone, and releases the corresponding quotas simultaneously. Make sure to check all members to be deleted in the confirmation dialog before you proceed.
Filtering/Sorting
On the Exposed Probes page, click the search box to filter probe exposure events by keywords such as probe ID and probe name. Click Region, VPC, Deployment method, Deployment instance, and Forwarder in the probe exposure list to filter probe exposure events. You can filter by honeynet ID or honeynet type to quickly locate all probes in the same honeynet. For ordinary probes that do not belong to a honeynet, this field is displayed as -.
Click Forward to Honeypot and Hit count in the probe exposure list to display probe exposure events in ascending or descending order.