SentryPeer is a specialised honeypot and fraud-detection system for SIP and VoIP infrastructure. It exposes a SIP service to hostile traffic and records information such as the originating IP address and telephone numbers that attackers attempt to call. This intelligence can then be used by PBX operators, service providers and other telecommunications systems to identify suspicious activity.
A particularly interesting aspect of SentryPeer is its approach to ownership and sharing of threat data. Information can remain entirely local, while operators who want to participate can opt into peer-to-peer distribution. This allows several nodes to contribute and consume observations without making a mandatory centralised service the sole repository for collected data.
This is free and open source software.
Key Features
- Collects SIP probes, registration attempts and attempted telephone numbers.
- Supports UDP, TCP and TLS transports.
- Embedded distributed hash table functionality using OpenDHT.
- Optional peer-to-peer sharing and replication of collected bad-actor data.
- Allows operators to specify their own DHT bootstrap node.
- Local SQLite database for retained observations.
- JSON file logging and syslog integration.
- REST API for querying observed IP addresses and telephone numbers.
- Webhook support for forwarding captured events as JSON.
- Fail2ban integration through syslog.
- SIP functionality can be disabled when the software is required only as an API or distributed-data node.
- Supports a responsive SIP mode for collecting additional interaction data.
- Can integrate with SentryPeerHQ using OAuth2 credentials.
- Designed to provide a relatively small binary suitable for constrained deployments.
Website: github.com/SentryPeer/SentryPeer
Support:
Developer: Gavin Henry
License: GNU General Public License v2.0 or GNU General Public License v3.0
SentryPeer is written in C. Learn C with our recommended free books and free tutorials.
Related Software
| Honeypot Tools | |
|---|---|
| OpenCanary | Multi-protocol network decoy for detecting attacks |
| Dionaea | Traps exploits and captures malware samples |
| SentryPeer | Spots malicious SIP traffic and attempts to abuse VoIP systems |
| Heralding | Records usernames and passwords submitted by attackers |
| h0neytr4p | Web-focused trap for inspecting hostile HTTP requests and probing |
Read our verdict in the software roundup.
 LinuxLinks helps you discover the best free and open source software for Linux. Explore our extensive collection of recommended applications, including alternatives to popular proprietary software.We also publish software reviews, Linux tutorials, hardware reviews, free programming books and articles covering the wider open source community. Browse our Linux resources to discover more. Know a useful free and open source Linux application we haven't covered? Suggest a program for inclusion. Has your software been featured on LinuxLinks? Display one of our Featured on LinuxLinks badges on your website or GitHub README. |
Please read our Comment Policy before commenting.