Dionaea
Low-interaction honeypot that captures attacking malware over SMB, HTTP, FTP, and MQTT.
Technical Architecture & Overview
Dionaea exposes vulnerable network services, records exploit attempts, and captures the malware payloads attackers drop. It was built as a successor to the Nepenthes low-interaction honeypot, adding Python scripting, libemu shellcode detection, and IPv6 and TLS support. It remains bundled in T-Pot for malware collection sensors. Direct development has stalled, with the last meaningful repository activity in 2024, so it should be treated as dormant.
Targeted Technical Use Cases
Malware collection sensors where a proven capture tool matters more than active maintenance.
Evaluation & Trade-offs
Core Strengths
- +Long track record of capturing worm and bot payloads.
- +Simple to deploy and integrate with capture pipelines.
- +Still distributed through T-Pot.
Trade-Offs & Limitations
- -Effectively unmaintained as a standalone project.
- -Coverage skews toward older exploit patterns.
Defensive Security Application
Collecting live malware samples from network attacks for analysis and signature creation.
Frequently Asked Questions
What is Dionaea?→
Dionaea exposes vulnerable network services, records exploit attempts, and captures the malware payloads attackers drop. It was built as a successor to the Nepenthes low-interaction honeypot, adding Python scripting, libemu shellcode detection, and IPv6 and TLS support. It remains bundled in T-Pot for malware collection sensors. Direct development has stalled, with the last meaningful repository activity in 2024, so it should be treated as dormant.
What is Dionaea used for?→
Malware collection sensors where a proven capture tool matters more than active maintenance.
What are the strengths of Dionaea?→
- +Long track record of capturing worm and bot payloads.
- +Simple to deploy and integrate with capture pipelines.
- +Still distributed through T-Pot.
What are the limitations of Dionaea?→
- +Effectively unmaintained as a standalone project.
- +Coverage skews toward older exploit patterns.
How is Dionaea used defensively?→
Collecting live malware samples from network attacks for analysis and signature creation.