Honeyd

Overview

Honeyd is a self-hosted daemon for creating virtual hosts and network honeypots for threat detection, assessment, and simulation. It suits network operators who can configure routing and want to model many hosts; it is a poor fit for anyone seeking a ready-to-run decoy.

Its GPL license and free price remove procurement barriers, while the combination of large-scale address claims, service emulation, and controllable network behavior gives experienced defenders an unusually broad simulation tool. The trade-off is operational: Honeyd does not receive traffic by itself, and running an exposed deception system demands isolation.

Key features

Virtual hosts and services

A single Honeyd host can claim up to 65,536 IP addresses, and the daemon can simulate thousands of virtual hosts concurrently. Each virtual host can imitate arbitrary services from configuration files or proxy a service to another machine. This is a strong fit for network-level deception, monitoring, and assessment environments where many decoys matter. It is more work than a focused single-service honeypot because the operator must define the personalities and services.

Operating-system and network behavior

Honeyd changes TCP/IP behavior to emulate operating-system personalities that Nmap or Xprobe can identify. It can also construct virtual routing topologies with configurable latency, packet loss, asymmetric routes, physical hosts, and GRE tunnels. Those controls support realistic test networks and honeynets rather than merely changing banners. They reward administrators comfortable with routing and tunnel configuration, but add little value for someone who only wants to expose one instrumented service.

Logging, routing, and isolation

The -l option writes flow logs for connections and packets, including protocol and connection details plus passive OS-identification comments. Honeyd does not intercept traffic automatically: traffic must be directed to it through routing, proxy ARP, or arpd. That separation gives an operator control over deployment, but makes network design a prerequisite rather than a setup detail. Because scripts and adversaries can be malicious, the maker recommends sandboxing Honeyd with Systrace; this is a necessary part of a responsible deployment.

Pricing

Honeyd — free. It is distributed free of charge under the GNU General Public License, with self-hosted deployment and no paid tier. That makes it suitable for laboratories, academic work, and teams able to supply their own hosts and network controls. The price does not remove the administrative cost of configuring traffic delivery, writing decoy definitions, and securing the daemon.

Platforms

Honeyd is self-hosted on Linux and Windows, and the download guidance says it should compile and run on *BSD, GNU/Linux, and Solaris. The FAQ describes a Windows port for Honeyd 0.5. Dependencies and integrations include libevent, libdnet, libpcap, Nmap, Xprobe, and GRE tunneling. The latest listed release is Honeyd 1.5c from May 27, 2007, so organizations should account for the age of the release when selecting it for current environments.

Who it's for

Honeyd is aimed at security teams, researchers, and network operators building host-based or network-based virtual honeypots, virtual honeynets, monitoring systems, or controlled network simulations. It is a good choice when scale, fingerprintable OS behavior, and topology control are central requirements. It is not the right choice for users who need automatic traffic capture, an appliance-like workflow, or a narrowly scoped SSH or Telnet decoy.

Pros and cons

• Pro: One host can represent up to 65,536 IP addresses and thousands of virtual hosts, enabling broad network deception.
• Pro: Configurable services, OS fingerprints, routing conditions, physical hosts, and GRE tunnels support detailed simulations.
• Pro: Free, GPL-licensed software can be deployed without per-seat or usage charges.
• Con: Traffic requires routing, proxy ARP, or arpd configuration; Honeyd will not automatically intercept it.
• Con: Safe operation calls for sandboxing with Systrace because the daemon handles hostile traffic and scripts.
• Con: The latest listed release dates to 2007, making release currency a serious consideration for new deployments.

Alternatives

For a broader directory of choices, see Honeypot Software.

• Canarytokens is the better pick for free tokens across web, mobile, Windows, and self-hosted environments rather than large virtual networks.
• OpenCanary suits Linux, macOS, and self-hosted deployments when an open-source honeypot with a narrower footprint is preferable.
• T-Pot is a free, open-source self-hosted option for teams prepared to meet its hardware and network requirements.
• Beelzebub offers a free open-source core with self-hosted deployment and a trial option.
• Cowrie is the focused choice for a free SSH and Telnet honeypot.
• Endlessh is a standalone SSH tarpit with a default maximum of 4,096 clients.
• Honeytrap provides free Apache-licensed, self-managed honeypot software.
• MedPot is a free open-source repository for Linux and self-hosting, requiring Go 1.17 or newer.

Verdict

Choose Honeyd if you need a free, self-hosted framework for simulating many network hosts, identifiable operating-system behaviors, and configurable topologies. Its main reason to choose it is breadth without licensing cost; its main reason to look elsewhere is the combination of manual traffic plumbing, required isolation, and a latest listed release from 2007.