Discover honeypot addresses
To discover actual addresses for detection, examine your
syslog output for addresses that were rejected as
unknown. One way to do this might look like the following,
where the actual command is on huge line:
% cd /var/log
% grep "User unknown" syslog* | sed -e 's/.*<//' -e 's/>.*//' -e 's/\.\.\..*//' | sort | uniq -c | sort -n
maillog or something
else (see your /etc/syslog.conf file if in doubt). Partial output
of this command might look like this: