Nowadays, the urge for an insight in suspicious traffic traveling on the networks is becoming a main issue in the cyber security field. Taking advantage of a monitoring infrastructure already installed comprising passive and active sensors, such as Darknets and honeypots, we focus on a specific one, the Heralding honeypot. Honeypots are becoming a classical tool in cyber security policies since they can be useful to monitor and identify new attacks. More specifically, they are placed in the internet and build ad-hoc to be attacked, usually miming the behavior of unsafe system and so interacting with the incoming traffic. A comprehensive analysis of this collected data by honeypot, gives the possibility to observe closer new arising bot nets or DDoS attacks.