Dionaea
Honeypot that traps malware exploiting network services such as SMB, HTTP, FTP, and MQTT.
Technical Architecture & Overview
Dionaea exposes vulnerable network services, records exploit attempts, and captures the malware payloads attackers drop. It was built as a successor to the Nepenthes honeypot, adding Python scripting, libemu shellcode detection, and IPv6 and TLS support. It remains bundled in T-Pot for malware collection sensors. Direct development has stalled, with the last commit to the master branch in February 2021, so it should be treated as dormant.
Targeted Technical Use Cases
Malware collection sensors where a capture tool matters more than active maintenance.
Evaluation & Trade-offs
Core Strengths
- +Emulates many services, including SMB, MSSQL, MySQL, SIP, and UPnP.
- +Logs to JSON, SQLite, hpfeeds, and fail2ban for capture pipelines.
- +Still distributed through T-Pot.
Trade-Offs & Limitations
- -Effectively unmaintained as a standalone project.
- -Documentation recommends older platforms such as Ubuntu 18.04 and Debian 10.
Defensive Security Application
Collecting live malware samples from network attacks for analysis.
Frequently Asked Questions
What is Dionaea?→
Dionaea exposes vulnerable network services, records exploit attempts, and captures the malware payloads attackers drop. It was built as a successor to the Nepenthes honeypot, adding Python scripting, libemu shellcode detection, and IPv6 and TLS support. It remains bundled in T-Pot for malware collection sensors. Direct development has stalled, with the last commit to the master branch in February 2021, so it should be treated as dormant.
What is Dionaea used for?→
Malware collection sensors where a capture tool matters more than active maintenance.
What are the strengths of Dionaea?→
- +Emulates many services, including SMB, MSSQL, MySQL, SIP, and UPnP.
- +Logs to JSON, SQLite, hpfeeds, and fail2ban for capture pipelines.
- +Still distributed through T-Pot.
What are the limitations of Dionaea?→
- +Effectively unmaintained as a standalone project.
- +Documentation recommends older platforms such as Ubuntu 18.04 and Debian 10.
How is Dionaea used defensively?→
Collecting live malware samples from network attacks for analysis.