SentryPeer is a specialised honeypot and fraud-detection system for SIP and VoIP infrastructure. It exposes a SIP service to hostile traffic and records information such as the originating IP address and telephone numbers that attackers attempt to call. This intelligence can then be used by PBX operators, service providers and other telecommunications systems to identify suspicious activity.
A particularly interesting aspect of SentryPeer is its approach to ownership and sharing of threat data. Information can remain entirely local, while operators who want to participate can opt into peer-to-peer distribution. This allows several nodes to contribute and consume observations without making a mandatory centralised service the sole repository for collected data.
This is free and open source software.
Key Features
- Collects SIP probes, registration attempts and attempted telephone numbers.
- Supports UDP, TCP and TLS transports.
- Embedded distributed hash table functionality using OpenDHT.
- Optional peer-to-peer sharing and replication of collected bad-actor data.
- Allows operators to specify their own DHT bootstrap node.
- Local SQLite database for retained observations.
- JSON file logging and syslog integration.
- REST API for querying observed IP addresses and telephone numbers.
- Webhook support for forwarding captured events as JSON.
- Fail2ban integration through syslog.
- SIP functionality can be disabled when the software is required only as an API or distributed-data node.
- Supports a responsive SIP mode for collecting additional interaction data.
- Can integrate with SentryPeerHQ using OAuth2 credentials.
- Designed to provide a relatively small binary suitable for constrained deployments.
Website: github.com/SentryPeer/SentryPeer
Support:
Developer: Gavin Henry
License: GNU General Public License v2.0 or GNU General Public License v3.0
SentryPeer is written in C. Learn C with our recommended free books and free tutorials.
Related Software
| Honeypot Tools | |
|---|---|
| OpenCanary | Multi-protocol network decoy for detecting attacks |
| Dionaea | Traps exploits and captures malware samples |
| SentryPeer | Spots malicious SIP traffic and attempts to abuse VoIP systems |
| Heralding | Records usernames and passwords submitted by attackers |
| h0neytr4p | Web-focused trap for inspecting hostile HTTP requests and probing |
Read our verdict in the software roundup.
 Explore our carefully curated directory of recommended free and open source software, covering every major software category.The directory forms part of our extensive collection of articles for Linux enthusiasts. It includes hundreds of detailed reviews, together with free and open source alternatives to proprietary software from companies such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. LinuxLinks also covers interesting projects worth exploring, Linux-compatible hardware, free programming books and tutorials, and much more. Know a useful free and open source Linux application that we haven’t covered? Tell us about it using our submission form. |
Please read our Comment Policy before commenting.