Why "Hynesim" ?

Hynesim stands for the "HYbrid NEtwork SIMulator".

But it's actually more than that :

• Open Source (GPL v3.0);
• Real and virtual machines can be freely connected together;
• Support for large networks through the use of low interaction / low footprint virtual hosts;
• Support for complex services through the use of virtualized high interaction hosts;
• Many backends supported, and more to come;
• Very user friendly GUI, but powerful nonetheless;
• Supports Real & Virtual network interaction through Ethernet, WiFi, Bluetooth.

But what can I do with Hynesim?

Like mentioned above, Hynesim is capable of simulating pretty much any information system (I.S.), as long as you have the resources. But what could be the use of simulating an I.S. ? For example you could use to:

• Conduct a security audit without risking the real I.S. ;
• Train personnel "on-the-job" without any risk for your existing infrastructure;
• Teach the principles of network and computer security using a realistic environment;
• Set-up large honeypots/honeynets over Internet;
• Research and experiment in information security, P2P technologies...

...and lots of other uses we haven't thought of!

How does it work?

Hynesim uses pre-existing virtualization technologies to provide high interaction hosts. Because things change very fast in the virtualisation world, we don't want to depend on any specific one. So we designed Hynesim to be able to provide a variety of backends, current ones are VirtualBox and KVM+Qemu, but expect more to come.

But because virtualization is costly in terms of resources, Hynesim also provides what we call low interaction hosts. These are virtual hosts with a low footprint, allowing you to spawn a lot of them. The downside is that they are very limited in what they can do. They're mostly just a IP stack with a couple of scripts as services. Same as with high interaction virtual hosts, backends are pluggable. We currently provide Honeyd and OpenVZ.

So this is how we simulate virtual machines.

But without interconnection, there's no information system :

So we also provide virtual switches and hubs, as well as routers, which can be either our minimalist router, or a fully fledged Cisco router running in Dynamips, or even a complete router-tailored Linux distribution running inside a high interaction host. Your choice.

And because a simulation is a lot more fun if you can interact with it, you can plug real machine anywhere inside the simulated I.S. .

Of course, to the real machine, the simulation is indistinguishable from a real I.S. . Or as they say "Welcome to the Matrix, Neo".

Sounds complicated?

Don't worry, to configure all this, a very user-friendly GUI is part of the Hynesim platform, that should satisfy newbies and expert alike.

Planned Features ?

• Automatic or scriptable life-like data flows from virtual users (such as emails with attachments, browsing, file downloads...) from virtual hosts to other, real or virtual, hosts;
• IPMorph: a tool currently in the work to fool OS Fingerprinting by tool such as Nmap, Xprobe, SinFP, p0f... For the moment, OS fingerprinting spoofing is only available for Honeyd virtual hosts, and it fools only XProbe and the old Nmap engine.