A Honeypot is a information gathering system, designed for attackers to interact with. A honeynet, simply put, is a network of honeypots. The key component of a honeynet is the honeywall. The honeywall is used to provide the following capabilities: Data Capture. The ability to collect information about the attack. Data Control. The ability to restrict the amount of damage that can be done from one of your honeypots to another network. Data Analysis. The ability to conduct limited forensics analysis on the network traffic or compromised honeypots in order to discover the attackers methodology. Data Alerting. The ability to alert an analyst as to suspicious activity. In 2001, Honeynet.org released a honeywall, called eeyore, which allowed for Gen II honeynets and improved both Data Capture and Data Control capabilities over the Gen I honeynets. In the summer of 2005, Honeynet.org released a new honeywall, called roo , which enables Gen III honeynets. The new roo has many improvements over eeyore: Improved installation, operation, customization Improved data capture capability by introducing a new hflow database schema and pcap-api for manipulating packet captures. Improved data analysis capability by introducing a new web based analysis tool called walleye. Improved user interfaces and online documentation The purpose of this presentation is to describe the new capabilities of Gen III honeynets and demonstrate the new roo. In addition, a road ahead will be discussed to describe a global honeygrid of connected honeynets.