yeah, this is what I was talking about. Once for a college project we had VMs acting as honeypots, to try to get the big bears (not just bots) so we changed OpenSSH source code, let them in at the 3rd try and then the idea was to send back through ICMP payloads the session keys to decrypt the communication, based on a nettables module hack published at phrack!