Cowrie

Cowrie is a free, open-source SSH and Telnet honeypot for teams that want to study hostile connections and attacker behavior. It is best suited to security researchers, CERTs and defenders comfortable running their own Linux deployment. Its strength is the depth of activity it can capture; it is not a managed monitoring service.

Overview

Cowrie records brute-force attempts and activity after an attacker connects. In its default mode, a Python-emulated UNIX environment and fake filesystem keep commands from running on the real host. That makes the emulated shell a useful decoy boundary, but operating the deployment and deciding how to expose it remain your responsibility.

Proxy mode instead forwards SSH and Telnet sessions to another system while monitoring behavior. This can provide visibility into sessions reaching that system, but it does not offer the same isolation as the fake shell.

Key features

Timed terminal recordings can be replayed with Cowrie’s playlog utility, helping investigators reconstruct the order and pace of a session. Cowrie also saves files retrieved with wget or curl and files uploaded through SFTP or SCP for later inspection. Those captures make the tool more useful for investigation than a honeypot that records connection attempts alone.

JSON event logs include logins, commands, downloads, TCP forwards and session metadata. Output plugins connect Cowrie to Elasticsearch, Splunk, Microsoft Sentinel, MISP, VirusTotal, Slack, Discord, MySQL, PostgreSQL, SQLite, MongoDB, Graylog, Kafka, Prometheus, Datadog and Amazon S3. That breadth can fit an existing security workflow, though integrating and operating those destinations is still part of a self-managed setup.

An experimental LLM backend can produce dynamic shell responses and retain conversational context across a session. Its experimental status makes it an option to explore, rather than a reason to choose Cowrie when predictable behavior is essential.

Pricing

Cowrie costs free. The free plan is the open-source, BSD-licensed honeypot; there are no paid tiers, seat counts, quotas or trial terms to weigh. In exchange for the zero price, deployment and ongoing operation are self-hosted rather than provided as a managed service.

Platforms

Cowrie runs on Linux and is self-hosted. Installation options include pip, Docker and a Git checkout; local requirements include Python 3.11+ and python-virtualenv. This suits operators who can provision and maintain their own environment, not readers seeking a hosted service or a turnkey cross-platform application.

Who it's for

The project identifies security researchers, CERTs and defenders as its users. It is a strong fit when the goal is to observe SSH and Telnet behavior, preserve session evidence and route events into an established analysis stack. Volunteer maintenance and community support through Slack and Discord suit users comfortable relying on an open-source project community rather than a commercial support arrangement.

Pros and cons

• Pros: The fake-filesystem shell keeps emulated commands off the real host, while timed replay, file capture and detailed JSON logs give investigators several kinds of evidence.
• Pros: A wide set of output integrations can connect activity to security, messaging, database and monitoring tools.
• Cons: Linux self-hosting and the Python requirements place setup and operation on the user.
• Cons: Proxy mode forwards sessions to another system, so it should not be treated as equivalent to the emulated shell’s isolation boundary.
• Cons: The LLM backend is experimental, and volunteer maintenance may not suit organizations that require commercial support.

Alternatives

Honeypot Software is a useful starting point for comparing options across the category. Choose Canarytokens instead if you want free tokens deployed through its hosted service or need its broader listed platform coverage, including mobile and web. OpenCanary is another free, self-hosted option for Linux and macOS.

T-Pot may suit users looking for a free open-source honeypot platform across more listed operating systems, provided its hardware and network requirements are acceptable. Beelzebub is a free self-hosted core framework for Linux and API use, and includes a free trial. For a narrower SSH decoy, Endlessh is a free Linux tarpit, with a default maximum of 4096 clients. Honeyd is a free GPL-licensed option for Linux and Windows; Honeytrap is free Apache-licensed, self-managed software for Linux. MedPot is another free Linux self-hosted choice, with Go 1.17 or newer required.

Verdict

Choose Cowrie if you need a free SSH and Telnet decoy that captures timed sessions, transferred files and structured activity for later analysis.