Conpot
Conpot is a free, open-source network honeypot for collecting intelligence about activity targeting industrial control systems.
What Conpot is
Conpot is a free, open-source network honeypot for collecting intelligence about activity targeting industrial control systems. Its default setup imitates a Siemens S7-200 CPU with expansion modules and exposes Modbus, HTTP, SNMP and S7comm. The project is a Linux/POSIX console application intended for developers, and it may also interest ICS security researchers and honeypot operators. It can run in Docker or be installed on a host from PyPI or source; the host installation guide requires Python 3.10 or newer. Operators can create templates and change ports to adapt the decoy. ConpotFS routes file access through a controlled location, avoiding permission changes to the actual file system. HPFeeds is supported but is off by default. Shared data is raw JSON, and access requires an HPFriends account, accepting the share and creating an auth key. The project uses the GPL-2.0 license, which provides the software without warranty. Documentation, a FAQ and GitHub issues are linked for support.
Good
- Free and open source under GPL-2.0.
- Default profile exposes four industrial and network protocols.
- Docker, PyPI and source deployment options.
- Templates and ports can be customized.
Watch out
- Host installation requires Python 3.10 or newer.
- HPFeeds is disabled by default.
- Shared data requires an HPFriends account and auth key.
- The license provides the software without warranty.
Who it suits
Conpot suits developers, ICS security researchers and honeypot operators looking to collect intelligence about attacks on industrial control systems. It is for users prepared to deploy and manage a self-hosted Linux/POSIX application.
Verdict
Conpot offers a customizable, self-hosted decoy for industrial control system environments. Factor in its host requirements and the extra steps for accessing shared data.
The facts
Each one read from Conpot's own pages, with the date it was checked.
What it does
- Customization
- Users can edit XML profiles to configure emulated device information, Modbus data blocks, and SNMP MIB values.checked 5 Oct 2026
- Data access
- The FAQ says users seeking shared Conpot data need an HPFriends account and must accept the share to create an auth key.checked 4 Oct 2026
- Data sharing
- Conpot supports HPFeeds for sharing attack data, and HPFeeds is disabled by default.checked 5 Oct 2026
- Default emulation
- The default profile emulates a Siemens S7-200 CPU with expansion modules and exposes Modbus, HTTP, SNMP, and s7comm.checked 5 Oct 2026
- Deployment
- The documentation offers Docker, Docker Compose, and direct host installation options.checked 5 Oct 2026
- Emulation
- The default profile emulates a Siemens S7-200 CPU and exposes MODBUS, HTTP, SNMP, and S7comm.checked 4 Oct 2026
- Host requirement
- The host installation guide says Conpot requires Python 3.10 or newer.checked 5 Oct 2026
- Intended audience
- Project metadata lists developers as the intended audience.checked 4 Oct 2026
- Intended users
- The project describes its purpose as gathering intelligence on attacks against industrial control systems, making it relevant to ICS security research and honeypot operators.checked 5 Oct 2026
- License
- The GitHub repository identifies the project license as GPL-2.0.checked 5 Oct 2026
- Purpose
- Conpot is an ICS honeypot designed to collect intelligence about adversaries targeting industrial control systems.checked 5 Oct 2026
- Runtime requirement
- The current host installation guide requires Python 3.10 or newer.checked 4 Oct 2026
- Safe file system
- ConpotFS proxies files from a controlled location and avoids changing permissions on the actual file system.checked 4 Oct 2026
- Security
- ConpotFS proxies files through a controlled location so protocol operations do not change the actual filesystem permissions.checked 5 Oct 2026
- Security limitation
- The customization guide warns that SNMP could be abused for traffic amplification and describes request rate limits to mitigate this risk.checked 5 Oct 2026
- Shared data format
- The FAQ describes shared data as raw JSON and says a Python client can consume it through HPFeeds.checked 5 Oct 2026
- Support
- The project links documentation, a FAQ, and GitHub issues, with no commercial support terms stated on the pages reviewed.checked 5 Oct 2026
- Supported environment
- The project metadata classifies Conpot as a console application for Linux/POSIX.checked 4 Oct 2026
The company
- Founded
- 2013checked 28 Sep 2026
Alternatives to Conpot
- 1
Canarytokens
Free planAndroidiOSWebSelf-hosted6.6Free plan - 2
OpenCanary
Free planLinuxmacOSSelf-hosted6.5Free plan - 3
Honeytrap
Free planLinuxSelf-hosted6.2Free plan - 4
KFSensor
Windows6.2From $120 a year - 5
Thinkst Canary
WebAPILinuxmacOS6.2From $7,500 a year - 6
Honeyd
Free planLinuxSelf-hostedWindows6.0Free plan