Honeyd

Overview

Honeyd is a free, open-source daemon for building virtual hosts, honeypots, and simulated networks. It is best suited to network defenders and researchers who can manage routing and self-hosted infrastructure. Its depth is impressive, but operating it safely and directing traffic to it require real networking expertise.

Key features

Large-scale virtual hosts

One Honeyd host can claim up to 65,536 IP addresses, and the daemon can represent thousands of virtual hosts simultaneously. Each host can imitate arbitrary services from configuration files or proxy a service to another machine. This makes Honeyd a strong choice for broad network deception, assessment labs, and honeynets; it is excessive for a single narrowly defined service decoy.

Operating-system and network emulation

Honeyd changes TCP/IP behavior to reproduce operating-system personalities that Nmap or Xprobe can identify. It can also construct virtual routing topologies with configurable latency, packet loss, asymmetric routes, physical hosts, and GRE tunnels. Those controls support realistic network simulations rather than simple banner-based traps, although they demand careful design and configuration.

Traffic control and logging

Honeyd does not capture traffic automatically. Operators must direct traffic to it through routing, proxy ARP, or arpd, so deployment planning is a substantive part of the job. The -l option writes flow logs covering protocols, connection and packet details, and passive OS-identification comments, giving investigators useful context for observed activity.

Security and ecosystem

Because the daemon interacts with potentially malicious adversaries and scripts, its maker recommends sandboxing it with Systrace. That precaution is particularly important in an exposed honeypot deployment. Documentation covers Nmap and Xprobe fingerprinting, GRE tunneling, and dependencies including libevent, libdnet, and libpcap. Honeyd is GPL-licensed open-source software, and unanswered questions can be directed to the maintainer by email.

Pricing

Honeyd costs free under its sole Honeyd plan. It is distributed free of charge under the GPL, with self-hosted deployment and no paid tier or seat-based allowance. The trade-off is operational rather than financial: you provide the host, networking, isolation, configuration, and maintenance yourself.

Platforms

Honeyd is self-hosted. The download guidance says it should compile and run on *BSD, GNU/Linux, and Solaris, while the FAQ describes a Windows port of Honeyd 0.5. The platform breadth helps teams working across Unix-like systems, but the latest listed release is Honeyd 1.5c from 2007-05-27, which should weigh heavily in platform and security planning.

Who it's for

Choose Honeyd if you need host-based or network-based virtual honeypots, virtual honeynets, or general network monitoring with control over thousands of simulated systems and their network behavior. It fits experienced administrators, incident-response teams, and researchers comfortable with routing, proxy ARP, GRE, and daemon sandboxing. It is a poor match for users who want an appliance-style honeypot, automatic traffic interception, or a narrowly scoped decoy with minimal upkeep.

Pros and cons

• Pro: Up to 65,536 IP addresses on one host and thousands of simultaneous virtual hosts support unusually broad network deception.
• Pro: Service proxying, OS fingerprint emulation, and configurable topology produce richer simulations than a basic listener.
• Pro: Flow logging includes packet, protocol, connection, and passive OS-identification information.
• Con: Traffic must be routed to Honeyd manually through routing, proxy ARP, or arpd.
• Con: The maker's sandboxing advice reflects genuine exposure when handling hostile traffic and scripts.
• Con: Honeyd 1.5c dates from 2007, making currency and maintenance a serious concern.

Alternatives

Honeypot Software is the broader category to browse when you want to compare approaches. Choose Canarytokens instead for free tokens deployed through its hosted service, with Android, iOS, web, Windows, and self-hosted options. OpenCanary is a free, open-source self-hosted choice for Linux and macOS. Honeytrap offers a free Apache-licensed, self-managed deployment on Linux. T-Pot is another free open-source self-hosted option spanning Linux, macOS, and Windows, provided your hardware and network meet its requirements. Beelzebub suits users wanting a free open-source core framework with a trial and API, Linux, or self-hosted deployment. Cowrie focuses on free, open-source SSH and Telnet honeypot work. Endlessh is a free standalone SSH tarpit for Linux, with a default maximum of 4,096 clients. MedPot is a free open-source repository for Linux and self-hosting that requires Go 1.17 or newer.

Verdict

Honeyd is worth choosing for technically capable teams that need large, programmable virtual networks and detailed protocol-level simulation without licensing cost. Look elsewhere if current maintenance, automatic traffic handling, or a simpler focused honeypot matters more than its exceptional scale and topology control.