Honeytrap

Overview

Honeytrap is an open-source system for building and coordinating honeypots on self-hosted Linux deployments. It suits security practitioners who want flexible decoys and centralized logging across multiple agents. Its breadth of traffic handling is compelling, but the project has no releases, which makes deployment less straightforward.

Key features

A honeypot can combine services such as a LAMP server, while payload detection routes requests to the service suited to the traffic and allows one port to handle multiple protocols. That flexibility helps administrators model varied targets without assigning a separate port to every protocol.

Honeytrap’s agent-and-server architecture is designed for distributed deployments: agents download configuration from a central server, which can coordinate many agents and consolidate their logs. Agents can also redirect traffic between networks. This is useful when decoys need centralized management, but it places deployment and operation responsibility on the team.

Interaction options span low to high, and connections can be upgraded to high interaction. Sensor listeners can complete a TCP handshake and store payloads to help monitor lateral movement. LXC or remote-host directors can build high-interaction honeypots by proxying traffic and extracting information. Honeytrap can also extend existing honeypots, including Cowrie and Glutton, with its listening and logging framework.

Filtering and logging integrations cover Elasticsearch, Kafka, Splunk, Raven, files, and the console. This gives teams several destinations for honeypot data, though they must run and maintain the surrounding infrastructure themselves.

Pricing

Honeytrap is free under its Open-source software plan: free. The Apache License 2.0 permits use of the code, and deployment is self-managed. There is no free trial because the software is free; the tradeoff is that users take on setup and ongoing operation rather than receiving a hosted service.

Platforms

Honeytrap supports Linux and self-hosted deployment. It is not a fit for readers seeking a hosted honeypot service or a turnkey desktop application.

Who it's for

Choose Honeytrap if you need to combine decoy services, tune traffic handling, and coordinate agents with centralized logging in a Linux environment. It is less suitable if you need a packaged release to install directly or prefer a provider to manage the deployment. The project directs users to the honeytrap-users mailing list for discussion.

Pros and cons

Pros

• Flexible decoy design: Multiple services and protocols can share a honeypot and port, supporting varied target configurations.
• Distributed coordination: A server can push agent configuration and centralize logging across many agents.
• Broad interaction and logging options: Low- through high-interaction setups and several logging destinations support different monitoring needs.

Cons

• No repository releases: The lack of releases makes it a weaker choice for users who want a conventional packaged installation.
• Self-managed Linux deployment: Teams must operate the deployment and its infrastructure themselves.

Alternatives

Browse honeypot software for more options. Canarytokens is a free alternative that spans Android, iOS, self-hosted, web, and Windows, with free tokens deployed through canarytokens.org. For another self-hosted option, OpenCanary is free and supports Linux and macOS.

T-Pot is a free, open-source self-hosted choice for Linux, macOS, and Windows, with hardware and network requirements to consider. Honeyd is a free GPL-licensed option for Linux, self-hosted, and Windows. Beelzebub offers a free self-hosted core framework for API and Linux environments, with a free trial also available.

Cowrie is a free, BSD-licensed SSH and Telnet honeypot for Linux and self-hosted use. Endlessh is a free standalone C SSH tarpit for Linux and self-hosted environments, with a default maximum of 4096 clients. Dionaea is a free GPLv2+ open-source honeypot for Linux and self-hosted use.

Verdict

Honeytrap is a strong choice for security practitioners who want configurable, multi-service honeypots and centralized agent management without a software fee. Its main reason to choose it is the combination of traffic flexibility, interaction levels, and logging integrations; look elsewhere if the absence of releases or the responsibility of self-hosting is a barrier.