Conpot

Free plan LinuxSelf-hosted

What Conpot is

Conpot is a self-hosted network honeypot for gathering intelligence about attacks aimed at industrial control systems. Its default profile imitates a Siemens S7-200 CPU with expansion modules and presents Modbus, HTTP, SNMP, and s7comm services. Operators can shape the decoy by creating templates and changing ports. Conpot runs on Linux/POSIX, and the project metadata classifies it as a console application intended for developers. It can be deployed in Docker or installed on a host from PyPI or source; the host installation guide requires Python 3.10 or newer. ConpotFS routes file access through a controlled location, helping protocol operations avoid changing permissions on the host’s actual file system. The software includes HPFeeds support, which is disabled by default. Shared data is available as raw JSON, and access requires an HPFriends account, accepting the data share, and creating an authentication key. Conpot is free and licensed under GPL-2.0. Its license provides no warranty. The project links documentation, a FAQ, and GitHub issues.

Who it suits

Conpot suits developers, ICS security researchers, and honeypot operators who want to run a network decoy focused on industrial control systems. It is a fit for users comfortable deploying software on Linux/POSIX, including through Docker or a host installation.

What it does well

Free and open source under GPL-2.0.
Default profile presents Siemens S7-200 emulation and four protocols.
Deployable with Docker, PyPI, or source.
Custom templates and port changes are supported.
ConpotFS proxies files through a controlled location.
HPFeeds support can share raw JSON data.

What to know first

Host installation requires Python 3.10 or newer.
HPFeeds is disabled by default.
Shared data access requires an HPFriends account and authentication key.
The license provides the software without warranty.

Limits

The host installation guide requires Python 3.10 or newer. HPFeeds is off by default, and shared data access requires an HPFriends account, accepting the share, and creating an auth key.

Getting started

Open the Conpot project website on GitHub.
Choose Docker or install on a Linux/POSIX host from PyPI or source.
For a host installation, use Python 3.10 or newer.
Configure the default profile or create templates and change ports.
Enable HPFeeds if you want to share data; obtain access to shared data through HPFriends.

Verdict

Choose Conpot if you need a free, self-hosted honeypot for industrial control system attack intelligence and want to customize the emulated environment. Look elsewhere if you need software with a warranty or want shared data without setting up HPFriends access.

Questions

Is Conpot free?

Yes. Conpot is free and the repository identifies its license as GPL-2.0.

Where does Conpot run?

It is classified as a Linux/POSIX console application and can be self-hosted.

How can I deploy Conpot?

It can run in Docker or be installed on a host from PyPI or source. Host installation requires Python 3.10 or newer.

What does its default profile emulate?

It imitates a Siemens S7-200 CPU with expansion modules and exposes Modbus, HTTP, SNMP, and s7comm.

Can Conpot share data?

It includes HPFeeds support, disabled by default. Shared data is raw JSON; access requires an HPFriends account, accepting the share, and creating an auth key.

What support resources are linked?

The project links documentation, a FAQ, and GitHub issues.

Facts from Conpot's own pages

Customization: Users can edit XML profiles to configure emulated device information, Modbus data blocks, and SNMP MIB values. · conpot.readthedocs.io, 5 Oct 2026
Data access: The FAQ says users seeking shared Conpot data need an HPFriends account and must accept the share to create an auth key. · conpot.readthedocs.io, 4 Oct 2026
Data sharing: Conpot supports HPFeeds for sharing attack data, and HPFeeds is disabled by default. · conpot.readthedocs.io, 5 Oct 2026
Default emulation: The default profile emulates a Siemens S7-200 CPU with expansion modules and exposes Modbus, HTTP, SNMP, and s7comm. · conpot.readthedocs.io, 5 Oct 2026
Deployment: The documentation offers Docker, Docker Compose, and direct host installation options. · conpot.readthedocs.io, 5 Oct 2026
Emulation: The default profile emulates a Siemens S7-200 CPU and exposes MODBUS, HTTP, SNMP, and S7comm. · conpot.readthedocs.io, 4 Oct 2026
Founded: 2013 · github.com, 28 Sept 2026
Host requirement: The host installation guide says Conpot requires Python 3.10 or newer. · conpot.readthedocs.io, 5 Oct 2026
Intended audience: Project metadata lists developers as the intended audience. · github.com, 4 Oct 2026
Intended users: The project describes its purpose as gathering intelligence on attacks against industrial control systems, making it relevant to ICS security research and honeypot operators. · github.com, 5 Oct 2026
License: The GitHub repository identifies the project license as GPL-2.0. · github.com, 5 Oct 2026
Purpose: Conpot is an ICS honeypot designed to collect intelligence about adversaries targeting industrial control systems. · github.com, 5 Oct 2026
Runtime requirement: The current host installation guide requires Python 3.10 or newer. · conpot.readthedocs.io, 4 Oct 2026
Safe file system: ConpotFS proxies files from a controlled location and avoids changing permissions on the actual file system. · conpot.readthedocs.io, 4 Oct 2026
Security: ConpotFS proxies files through a controlled location so protocol operations do not change the actual filesystem permissions. · conpot.readthedocs.io, 5 Oct 2026
Security limitation: The customization guide warns that SNMP could be abused for traffic amplification and describes request rate limits to mitigate this risk. · conpot.readthedocs.io, 5 Oct 2026
Shared data format: The FAQ describes shared data as raw JSON and says a Python client can consume it through HPFeeds. · conpot.readthedocs.io, 5 Oct 2026
Support: The project links documentation, a FAQ, and GitHub issues, with no commercial support terms stated on the pages reviewed. · github.com, 5 Oct 2026
Supported environment: The project metadata classifies Conpot as a console application for Linux/POSIX. · github.com, 4 Oct 2026

Where Conpot stands on Freedom251

Honeypot Software#7 of 21