Deploying multiple instantiations of an Industrial Control System (ICS) honeypot is a difficult, time consuming, and costly prospect. The proprietary, and often expensive, hardware and software used by ICS devices create the challenging problem of building a flexible, economical, and scalable honeypot. This presentation proposes two methods for overcoming the scalability problem. Together, they provide a novel framework for creating a distributed ICS honeynet. The first method uses intelligent network traffic capture and replay techniques in order to create low interaction honeypots. The second method uses proxy technology to produce multiple high-interaction honeypots using a single physical device. This provides a cost-effective method for distributing multiple honeypots for the cost of one physical device. The two methods can be used together to create a hybrid distributed honeynet framework that has the fidelity provided by proxying to a physical device while maintaining the performance and scalability provided by replay techniques.