Conpot
Low-interaction ICS/SCADA honeypot simulating industrial controllers and protocols.
Technical Architecture & Overview
Conpot, from the Honeynet Project ecosystem, emulates industrial devices such as PLCs and RTUs over protocols including Modbus, S7, and SNMP, presenting a plausible control-system facade that logs every query. It is the standard choice for collecting industrial-protocol attack data in research and sensor networks, and it ships as one of the honeypots bundled in T-Pot. Tagged releases are infrequent, so deployments usually track the repository main branch.
Targeted Technical Use Cases
Research and sensor deployments that need industrial-protocol decoys without real equipment risk.
Evaluation & Trade-offs
Core Strengths
- +Purpose-built for ICS/SCADA deception.
- +Multiple industrial protocols in one instance.
- +Established research lineage.
Trade-Offs & Limitations
- -Infrequent tagged releases; commit activity is modest.
- -Emulation depth trails modern proprietary ICS honeypots.
Defensive Security Application
Detecting ICS-targeted reconnaissance and capturing protocol-level attacker behavior.
Frequently Asked Questions
What is Conpot?→
Conpot, from the Honeynet Project ecosystem, emulates industrial devices such as PLCs and RTUs over protocols including Modbus, S7, and SNMP, presenting a plausible control-system facade that logs every query. It is the standard choice for collecting industrial-protocol attack data in research and sensor networks, and it ships as one of the honeypots bundled in T-Pot. Tagged releases are infrequent, so deployments usually track the repository main branch.
What is Conpot used for?→
Research and sensor deployments that need industrial-protocol decoys without real equipment risk.
What are the strengths of Conpot?→
- +Purpose-built for ICS/SCADA deception.
- +Multiple industrial protocols in one instance.
- +Established research lineage.
What are the limitations of Conpot?→
- +Infrequent tagged releases; commit activity is modest.
- +Emulation depth trails modern proprietary ICS honeypots.
How is Conpot used defensively?→
Detecting ICS-targeted reconnaissance and capturing protocol-level attacker behavior.