We had this debate at our local OWASP chapter last night about whether a honeypot should strike back.  We did talk about some legal and moral issues however decided it was not a good idea because:


The majority of attacks are coming from dumb clients on botnets or through automated tools, so what are you actually achieving by taking out yet-another-dumb client?
The focus of your business should be aligned to your business objectives - fighting cybercrime (unless you work for a police authority) should not form part of that.
If the attack becomes serious and you need to go to court; evidence that you "striked back" would not look good and could work against you.  if you are going to spend money in this topic then spend it on forensic tools so that it strengthens any legal action
circular attacks:  consider if you accidentally strike back at another tool that has strike back capability?  then you're just eating up bandwidth unnecessarily.


Is hacking back a valid security technique for companies?
During a massive 10 hour scp over the internet, I ran out of disk space at the destination after 7 hours.

Can I use rsync or something else to run this to completion or am I **ed and have to start all over again?

If I have to start over, I think I will use rsync in case the ISP craps out this time...
