Dionaea is a network honeypot built to attract hostile traffic and record what attackers do when they encounter apparently vulnerable services. It was conceived as a successor to Nepenthes and is particularly suited to collecting information about automated attacks, exploitation attempts and malicious network activity.
Rather than concentrating solely on usernames and passwords, Dionaea exposes a broad collection of network services that attackers and automated scanners can interact with. This makes it useful for observing exploitation behaviour across several classes of service from a single deployment. Its architecture also embeds Python as a scripting language, allowing functionality to be extended without implementing everything in the core.
This is free and open source software.
Key Features
- Uses libemu to detect and analyse shellcode received from attackers.
- Supports IPv6 networking.
- Supports encrypted connections using TLS.
- FTP and HTTP service emulation.
- SMB, Microsoft SQL Server and MySQL services.
- MQTT and Memcached protocol support.
- SIP, TFTP, UPnP and PPTP services.
- EPMAP support for attracting activity targeting Microsoft RPC infrastructure.
- Blackhole and mirror services for additional traffic-collection scenarios.
- JSON logging for straightforward ingestion by external analysis tools.
- SQLite logging for retaining captured events in a structured local database.
- hpfeeds support for forwarding honeypot events to collection infrastructure.
- Fail2ban-compatible logging is available.
- Python can be used to implement and extend protocol functionality.
Website: github.com/DinoTools/dionaea
Support:
Developer: DinoTools
License: GNU General Public License v2.0
Related Software
| Honeypot Tools | |
|---|---|
| OpenCanary | Multi-protocol network decoy for detecting attacks |
| Dionaea | Traps exploits and captures malware samples |
| SentryPeer | Spots malicious SIP traffic and attempts to abuse VoIP systems |
| Heralding | Records usernames and passwords submitted by attackers |
| h0neytr4p | Web-focused trap for inspecting hostile HTTP requests and probing |
Read our verdict in the software roundup.
 Explore our carefully curated directory of recommended free and open source software, covering every major software category.The directory forms part of our extensive collection of articles for Linux enthusiasts. It includes hundreds of detailed reviews, together with free and open source alternatives to proprietary software from companies such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. LinuxLinks also covers interesting projects worth exploring, Linux-compatible hardware, free programming books and tutorials, and much more. Know a useful free and open source Linux application that we haven’t covered? Tell us about it using our submission form. |
Please read our Comment Policy before commenting.