The challenge is determining from vast amounts of information what is production traffic and what is malicious activity. Tools and techniques such as Intrusion Detection Systems, host based forensics, or system log analysis attempt to solve this by using known signatures based on previous attacks to determine what is production traffic and what is malicious activity. However, information overload, data pollution, unknown activity, false positives and false negatives can make analyzing and determining activity extremely difficult. The Honeynet solves this through simplicity. A Honeynet is a network designed to be compromised, not to be used for production traffic.
Any traffic entering or leaving the network is suspicious by definition.
Any connection initiated from outside the Honeynet into the network is most likely some type of probe, attack, or other malicious activity. Any connection initiated from the Honeynet to an outside network indicates that a system was compromised. This greatly simplifies the data capture and analysis. To successfully build a Honeynet, there are two critical elements, data control and data capture. Data control is the containment of activity, this means you control what packets can go where.