Honeyd Implementation

TCP handler more complicated.
Requires complete TCP state machine.
State machines tries to be as correct as possible.
It is not.
Initially, ports may be in LISTEN or CLOSED state.

LISTEN state causes three way handshake and all the other required TCP states.
Connection 4-tuple stored in a Splay tree.

CLOSED state causes a TCP Reset to be sent.