Dionaea

What Dionaea is

Dionaea is a self-hosted Linux honeypot designed to catch malware attempting to exploit network services, with the goal of obtaining a malware copy. It embeds Python and uses libemu to detect shellcode. The service can expose TCP, UDP and TLS services for IPv4 and IPv6, including FTP, HTTP, MQTT, MSSQL, MySQL, SIP, SMB, TFTP and UPnP. Incident handlers can route selected information to JSON, SQLite, SQL or hpfeeds. Documentation also describes collecting and visualizing JSON logs with the ELK stack. Dionaea is available as source code and an official Docker image, and the project lists it as GPLv2+ open source, with other licenses for its TFTP service and parts of FTP. The documentation warns that the software may contain exploitable bugs; it can drop privileges and use chroot to reduce potential impact. Installation guidance recommends Ubuntu 18.04 LTS or Debian 10 with Python 3.9 or 3.8, and cautions against Ubuntu 20.04 and Debian 11 because of libemu package availability at the time of that guidance.