Conpot
Low-interaction ICS/SCADA honeypot simulating industrial controllers and protocols.
Technical Architecture & Overview
Conpot, developed under the umbrella of the Honeynet Project, emulates industrial control system devices, such as a Siemens S7-200 PLC in its default template, over protocols including Modbus, S7, BACnet, and SNMP. It ships as one of the honeypots bundled in T-Pot. Version 1.0.0 rebuilt the runtime on asyncio and moved templates from XML to TOML.
Targeted Technical Use Cases
Research and sensor deployments that need industrial-protocol decoys without real equipment risk.
Evaluation & Trade-offs
Core Strengths
- +Purpose-built for ICS/SCADA deception.
- +Multiple industrial protocols in one instance.
- +Built-in hpfeeds support for sharing captured data.
Trade-Offs & Limitations
- -Version 1.0.0 is a breaking upgrade that requires template and log consumer migration.
- -Low-interaction design, so emulation is limited to the protocol stacks and template data provided.
Defensive Security Application
Detecting ICS-targeted reconnaissance and capturing protocol-level attacker behavior.
Frequently Asked Questions
What is Conpot?→
Conpot, developed under the umbrella of the Honeynet Project, emulates industrial control system devices, such as a Siemens S7-200 PLC in its default template, over protocols including Modbus, S7, BACnet, and SNMP. It ships as one of the honeypots bundled in T-Pot. Version 1.0.0 rebuilt the runtime on asyncio and moved templates from XML to TOML.
What is Conpot used for?→
Research and sensor deployments that need industrial-protocol decoys without real equipment risk.
What are the strengths of Conpot?→
- +Purpose-built for ICS/SCADA deception.
- +Multiple industrial protocols in one instance.
- +Built-in hpfeeds support for sharing captured data.
What are the limitations of Conpot?→
- +Version 1.0.0 is a breaking upgrade that requires template and log consumer migration.
- +Low-interaction design, so emulation is limited to the protocol stacks and template data provided.
How is Conpot used defensively?→
Detecting ICS-targeted reconnaissance and capturing protocol-level attacker behavior.