T-Pot

T-Pot is a self-hosted honeypot platform for security practitioners who can provision and isolate dedicated infrastructure. Its breadth of decoys and integrated analysis tools make it a strong fit for a lab or distributed monitoring setup, but the hardware demands and security caveats rule it out as a casual install.

Overview

T-Pot combines more than 20 honeypots in a multi-layer platform, with standalone and distributed deployment options. Distributed installations can use hive and sensor types, which suits teams separating collection from central analysis; a standalone deployment fits a single system. In either case, users operate the infrastructure themselves, and the project provides no support commitment.

Recommended hardware is 16 GB RAM and a 256 GB SSD for a hive, or 8 GB RAM and a 128 GB SSD for a sensor. Those requirements are substantial for a home lab and should shape the decision before deployment. T-Pot submits data to Sicherheitstacho by default; users can disable this by removing the ewsposter section from the configuration.

The project cautions that compromise cannot be ruled out and says honeypots should not contain sensitive data. That makes isolation a core deployment requirement, not a minor operational preference. Log persistence defaults to 30 cycles and Elasticsearch indices to 30 days; both settings can be adjusted.

Key features

T-Pot uses Elasticsearch to store events, Logstash to ingest and send them, and Kibana dashboards to present them. This gives operators an integrated path from captured activity to review, rather than a collection of decoys without a shared analysis layer.

Network security monitoring tools include Fatt, P0f, and Suricata. An animated attack map, CyberChef, Elasticvue, and Spiderfoot add visualization and analysis utilities. The combination is broad, but it also means T-Pot is best suited to users prepared to manage a substantial security stack.

Beelzebub and Galah honeypots require Ollama. ChatGPT support is described as untested with T-Pot, so users should not choose the platform on the assumption that this integration is ready for dependable use.

Pricing

T-Pot is free: the T-Pot plan costs nothing and is open-source and self-hosted. There is no free trial because the software is free to run. The price does not include the hardware or network capacity required to operate it, and there is no hosted plan or support commitment described.

Platforms

T-Pot supports documented Linux distributions. macOS and Windows deployments use Docker Desktop and have a limited feature set, so Linux is the more appropriate choice for users seeking the project's full deployment options. Self-hosting is the operating model across platforms.

Who it's for

T-Pot is for security teams and technically capable users who want multiple honeypots, event analysis, and monitoring tools in one self-managed platform. Its hive-and-sensor options make it particularly relevant to users planning distributed collection. It is a poor fit for anyone without dedicated resources, unwilling to maintain infrastructure, or unable to isolate a system that could be compromised.

Pros and cons

• Pros: More than 20 honeypots, an Elasticsearch-Logstash-Kibana analysis stack, and network monitoring tools are brought together in one platform.
• Pros: Standalone and distributed hive-and-sensor deployments support different collection architectures.
• Pros: The software is free and open source, with adjustable log persistence and index retention.
• Cons: Recommended RAM and SSD requirements are high for a small lab or spare machine.
• Cons: Data sharing is enabled by default, and disabling it requires a configuration change.
• Cons: The project warns that compromise is possible, advises against storing sensitive data in honeypots, and offers no support commitment.
• Cons: macOS and Windows use a limited-feature Docker Desktop setup.

Alternatives

Honeypot Software is the broader category for comparing options. Choose Canarytokens if free tokens deployed through canarytokens.org better suit the job than running T-Pot's self-hosted multi-honeypot stack. OpenCanary is a free, open-source self-hosted option for users seeking an alternative on Linux or macOS.

Honeytrap is another free, self-managed Linux honeypot option. Honeyd may suit users who want a free, GPL-licensed option for Linux or Windows. Beelzebub is a free self-hosted core framework with a trial, and may suit users looking specifically for that framework rather than T-Pot's broader bundle.

Cowrie is a free, BSD-licensed SSH and Telnet honeypot for users focused on those protocols. Endlessh is a free standalone C SSH tarpit, with a default maximum of 4096 clients. MedPot is a free open-source repository that requires Go 1.17 or newer.

Verdict

Choose T-Pot if you want a broad, free honeypot platform with integrated event analysis and monitoring, and have the hardware and operational discipline to isolate and maintain it. Its main advantage is how much it consolidates; look elsewhere if you need a hosted, supported service, a lightweight deployment, or a system that does not carry an explicit compromise risk.