FREEDOM251

Freedom251 › Honeypot Software

Dionaea

Free plan LinuxSelf-hosted

Visit Dionaea Alternatives Pricing

Dionaea's own site

What Dionaea is

Dionaea is a free, self-hosted Linux honeypot intended to trap malware exploiting network services, with the goal of obtaining a copy of it. It embeds Python and uses libemu to detect shellcode. Dionaea can offer services over TCP, UDP, and TLS for IPv4 and IPv6, including FTP, HTTP, MQTT, MSSQL, MySQL, SIP, SMB, TFTP, and UPnP. Incident handlers can route selected information into JSON, SQLite, SQL, or hpfeeds formats; the documentation also describes using JSON logs with the ELK stack to collect and visualize attack information. The project provides source code and an official Docker image. Its repository lists GPLv2+, with other licenses applying to the TFTP service and parts of FTP. Installation guidance recommends Ubuntu 18.04 LTS or Debian 10 and Python 3.9 or 3.8, while warning that Ubuntu 20.04 and Debian 11 had libemu package availability concerns at the time of the guidance. The documentation warns Dionaea may contain exploitable bugs and describes dropping privileges and using chroot to reduce potential impact.

Who it suits

Dionaea suits security teams or researchers who want a self-hosted honeypot for network services and can work with its documented Linux installation guidance. It also offers logging options for incident handlers.

What it does well

  • Supports TCP, UDP, and TLS services
  • Lists a broad set of network protocols
  • Routes incident information to JSON, SQLite, SQL, or hpfeeds
  • Official Docker image is available
  • Free and open source

What to know first

  • Documentation warns it may contain exploitable bugs
  • Installation guidance cautions against Ubuntu 20.04 and Debian 11
  • DionaeaFR frontend is marked unmaintained since 2014

Plans

PlanBilled and limitsPrice
DionaeaOpen-source honeypot; GPLv2+Free

As github.com lists them, read 4 Oct 2026. The maker's own page has the final word.

Getting started

  1. Choose a self-hosted Linux deployment.
  2. Use the official Docker image or obtain source code from the release page or Git repository.
  3. For installation, the guidance recommends Ubuntu 18.04 LTS or Debian 10 and Python 3.9 or 3.8.
  4. Configure the network services and TCP or TLS connection limits as needed.
  5. Route selected incident information to a supported format; the documentation describes using JSON logs with the ELK stack.

Verdict

Dionaea provides a broad range of network-service honeypot protocols, logging formats, and deployment choices. Review the documented system guidance and security warning before deploying it.

Questions

How much does Dionaea cost?

The listed Dionaea plan is free. It is open source.

Which platforms does Dionaea support?

It is listed for Linux and self-hosted deployment. Installation guidance recommends Ubuntu 18.04 LTS or Debian 10 and Python 3.9 or 3.8.

Is Dionaea open source?

Yes. The repository lists GPLv2+; the TFTP service uses the CNRI Python License, and parts of FTP use MIT.

Can Dionaea send data to the ELK stack?

The documentation describes using log_json with the ELK stack to collect, aggregate, and visualize attack information.

Where can users get help?

The documentation points users to the GitHub issue tracker and also mentions mailing-list and IRC support channels.

Facts from Dionaea's own pages

Connection controls
Dionaea can apply rate and accounting limits to TCP and TLS connections when required. · dionaea.readthedocs.io, 4 Oct 2026
Deployment
The project provides an official Docker image and source code downloads from its release page or Git repository. · dionaea.readthedocs.io, 4 Oct 2026
Documented systems
Installation guidance recommends Ubuntu 18.04 LTS or Debian 10 and Python 3.9 or 3.8; it cautions against Ubuntu 20.04 and Debian 11 due to libemu package availability at the time of writing. · dionaea.readthedocs.io, 4 Oct 2026
Honeypot platform
The DTAG Community Honeypot Project maintains T-Pot, a multi-honeypot platform that includes Dionaea. · dionaea.readthedocs.io, 4 Oct 2026
Integrations
The documentation describes using log_json with the ELK stack to collect, aggregate, and visualize attack information. · dionaea.readthedocs.io, 4 Oct 2026
Legacy integration
The DionaeaFR web frontend displays attack information using Dionaea's SQLite database, and the documentation marks it unmaintained since 2014. · dionaea.readthedocs.io, 4 Oct 2026
License
The repository lists Dionaea as GPLv2+, with a TFTP service under the CNRI Python License and parts of FTP under MIT. · github.com, 4 Oct 2026
Logging
Incident handlers can route selected incident information into formats such as JSON, SQLite, SQL, and hpfeeds. · dionaea.readthedocs.io, 4 Oct 2026
Network support
Dionaea can offer services over TCP, UDP, and TLS for IPv4 and IPv6. · dionaea.readthedocs.io, 4 Oct 2026
Protocols
Listed services include FTP, HTTP, MQTT, MSSQL, MySQL, SIP, SMB, TFTP, and UPnP. · github.com, 4 Oct 2026
Purpose
Dionaea is a honeypot intended to trap malware exploiting network services, with the goal of obtaining a copy of the malware. · dionaea.readthedocs.io, 4 Oct 2026
Security
The documentation says Dionaea may contain exploitable bugs and can drop privileges and chroot to reduce potential impact. · dionaea.readthedocs.io, 4 Oct 2026
Shellcode detection
The project describes Dionaea as embedding Python and using libemu to detect shellcode. · github.com, 4 Oct 2026
Support
The documentation directs users to the GitHub issue tracker for problems and also mentions mailing-list and IRC support channels. · dionaea.readthedocs.io, 4 Oct 2026

Where Dionaea stands on Freedom251

Look at these too