Honeyd Design

Packet routing on the Internet:
Router forwards IP packet according to destination IP address.
Each router on the path checks its routing table.
Destination IP on local link or not?

Local delivery:
Router needs to know MAC that corresponds to destination IP address.
ARP (address resolution protocol) matches MAC to IP address.

Arpd pretends that machines exist.
If Arpd sees an ARP request that is not being answered, Arpd answers with the MAC address of the Honeyd machine.