Dionaea is open-source honeypot software that emulates network services so attackers interact with a realistic target. Its purpose is to detect exploitation attempts and obtain copies of malware delivered through those services, with SMB as its principal protocol. Because the sensor is itself network-facing software, safe isolation, least privilege and controlled handling of captured files are essential.
What is Dionaea honeypot?
Dionaea is a network honeypot designed to attract exploitation attempts against emulated services and capture the malware or other payloads attackers send. The project documentation describes its intention as trapping malware that exploits vulnerabilities exposed by services offered to a network, with the ultimate goal of gaining a copy of the malware.
As an Amazon Associate I earn from qualifying purchases.
That makes Dionaea more than a passive packet logger. It accepts connections, speaks enough of a protocol to keep an attacker engaged, records incidents and can save uploaded files for later analysis. The software is a successor to nepenthes, embeds Python for scripting, uses a C network layer, and incorporates libemu to help detect shellcode. Documentation also describes IPv6 and TLS support.
Recommended Free Tools
A honeypot does not make a production service safer by itself. Dionaea is deliberately exposed and may contain exploitable defects. Treat it as a research or detection sensor in a separately controlled network, not as a substitute for patching, access control or endpoint protection.
#1 Best Overall
How Dionaea captures malware
Attackers often cannot deliver a payload in the first packet. A target may require protocol negotiation, authentication-like exchanges, a file request or a service-specific API call before the exploit is sent. Dionaea emulates those exchanges so the connection reaches the stage at which a payload can be observed.
- Connection and protocol negotiation: a scanner or attacker connects to an exposed Dionaea listener. The relevant module responds using the expected network protocol.
- Interaction: the attacker sends commands, requests or exploit data. Dionaea’s protocol implementations combine Python logic with the C networking layer and support non-blocking connections.
- Exploit and shellcode observation: when exploit traffic or shellcode appears, the sensor records an incident. The libemu integration can assist with shellcode detection.
- Payload acquisition: where the interaction causes a file upload or download, Dionaea can retain the resulting malware sample. SMB share uploads are specifically described in the project documentation.
- Logging and processing: incident details and file metadata can be sent to configured logging handlers or processors for alerting, correlation and analysis.
Rate limiting is configurable, which helps prevent a sensor from consuming all available resources when it receives scans or repeated exploit attempts. It is a containment and availability control, not a guarantee that malicious traffic cannot affect the host.
Which services and protocols does Dionaea support?
The official repository lists a broad module inventory. The list describes what the project contains; it does not mean every installation enables every listener. The active set depends on configuration, network exposure and the version or build being used.
| Module or service | Role in a sensor | Important qualification |
|---|---|---|
| SMB | Windows file-sharing protocol emulation, including share-upload scenarios | The documentation identifies SMB as Dionaea’s main protocol. |
| FTP | File-transfer service emulation | Support is listed in the repository; activation is configuration-dependent. |
| HTTP and HTTPS | Web-service interactions and payload delivery | The published service documentation describes both HTTP and HTTPS behavior. |
| SIP | Session Initiation Protocol interactions | Incident logging is documented, with optional RTP recording for media traffic. |
| MSSQL | Microsoft SQL Server protocol exposure | Supported as a module, not necessarily enabled in a default deployment. |
| MQTT | Message Queuing Telemetry Transport interactions | Useful for observing attacks aimed at messaging infrastructure when configured. |
| MySQL | Database-protocol emulation | Repository support does not establish a particular configuration’s fidelity or coverage. |
| TFTP | Trivial File Transfer Protocol activity | The project notes licensing exceptions affecting the TFTP module. |
| UPnP | Universal Plug and Play traffic | Exposure should be limited to a controlled research network. |
| EPMAP | Endpoint Mapper traffic | Listed in the project module inventory. |
| PPTP | Point-to-Point Tunneling Protocol traffic | Listed as a supported module. |
| Memcache | Memcached protocol interactions | Support is listed; enabled services depend on configuration. |
| Blackhole and mirror | Traffic-handling or sink-style functions in the module inventory | The repository lists them as modules; their exact behavior depends on the selected configuration. |
Because a service being present in source code is not the same as a listener being active, document your own configuration when interpreting data. A five-service deployment and a full module build are not equivalent sensors.
Rank #2
What can Dionaea log?
Dionaea’s repository lists logging options that include fail2ban, hpfeeds, JSON and SQLite. These outputs serve different operational needs: an enforcement-oriented handler, a feed transport, machine-readable incident records or a local relational store. Select handlers deliberately and restrict who can read collected data.
- JSON: useful when a security pipeline expects one structured record per event or file.
- SQLite: convenient for local inspection and small deployments, but it is not a replacement for protected, backed-up central storage.
- hpfeeds: can forward honeypot intelligence to a compatible feed architecture when that infrastructure is available.
- fail2ban: can connect observed activity to blocking workflows; do not let automated blocking accidentally cut off your management access or the rest of the lab.
Logging volume can increase rapidly during internet-wide scanning. Set retention, rotate files, monitor disk usage and ensure timestamps are synchronized. Preserve the original incident record before transforming it for a dashboard so later analysis can distinguish sensor evidence from enrichment.
Is Dionaea safe to run?
Only when it is treated as hostile-facing software. Dionaea’s own security documentation warns that software offering network services can contain exploitable bugs and that Dionaea is therefore likely to have exploitable bugs. The documentation describes dropping privileges and using a chroot as impact-reduction measures. Those controls reduce consequences; they do not make an exposed sensor safe by guarantee.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Build an isolated network position
- Place the sensor in a separate VLAN, virtual network or physically isolated segment with no route to production systems.
- Use firewall rules that allow only the research traffic you intentionally want to observe and a narrowly defined management path.
- Control outbound connections. A compromised sensor must not be able to scan internal networks or freely contact the internet.
- Keep administrative access separate from attacker-facing interfaces, and restrict credentials to the minimum required.
Reduce process impact
- Run with the lowest practical operating-system privileges after binding the required ports.
- Use the documented privilege-dropping and chroot capabilities, then verify the resulting filesystem and process permissions.
- Patch the host, runtime and dependencies independently of Dionaea’s service emulation. A honeypot is not exempt from ordinary vulnerability management.
- Apply resource limits and Dionaea rate limiting so bursts of traffic cannot exhaust CPU, memory or storage.
Protect captured malware
- Store samples outside ordinary user download directories and prevent accidental execution.
- Hash and label each file with its incident context before moving it for analysis.
- Transfer files to analysis machines through a controlled, one-way or tightly filtered process.
- Use isolated analysis environments with no route to production and no unnecessary internet access.
A practical deployment sequence
The documentation covers installation, Docker, configuration, running, integrations, logging handlers and processors. Exact commands vary by operating system and build, so use the configuration shipped with the version you install rather than copying a command intended for another release.
- Define the observation goal. Decide whether you need SMB exploitation telemetry, web attacks, database probing, SIP abuse or a combination. Fewer listeners make attribution and troubleshooting easier.
- Prepare the containment layer. Create the isolated network, firewall policy, management route, storage quota and a recovery plan for rebuilding the host.
- Install from the project’s documented method. Choose a package, source build or container approach that you can patch and monitor. Record the exact version, enabled modules and configuration files.
- Configure only intended services. Bind listeners to the isolated interface, set rate limits, choose logging handlers and define where incident files will be written.
- Apply privilege reduction. Configure the documented user and chroot settings, then test that logs and upload directories remain writable only where needed.
- Validate from a test host. Confirm that each expected port responds, that an incident is recorded, that a harmless test file follows the intended storage path and that no management route is exposed.
- Operate and monitor. Watch process health, disk consumption, connection rates, outbound traffic and log delivery. Keep a change record whenever you enable another module.
- Rebuild rather than trust a contaminated host. If evidence suggests compromise, isolate the machine, preserve forensic data according to your policy and redeploy from a known-good image.
How to analyze files Dionaea captures
Dionaea’s role is collection. Analysis should happen elsewhere, with controls appropriate for executable malware. A documented 2024 deployment transferred captured files to physically isolated analysis machines and used REMnux, Ghidra and GDB. That workflow illustrates a sound separation between the network sensor and reverse-engineering environment; it is not a built-in Dionaea default.
- Record the incident identifier, timestamp, source address, destination service and original filename.
- Calculate cryptographic hashes and preserve the untouched sample as evidence.
- Perform static inspection in an isolated environment before any execution, checking file type, embedded strings, headers and indicators.
- Use controlled dynamic analysis only on machines designed for malware work, with snapshots, restricted networking and a documented teardown process.
- Send normalized indicators and verdicts to the SIEM while retaining a link to the original incident record.
Never infer that a downloaded file is harmless because it arrived through an emulated service, and never execute it on the Dionaea host.
What the 2024 Dionaea case study shows
An article in Issues in Information Systems, Volume 25, Issue 1, pages 265–278 (2024), describes a customized Dionaea sensor exposing SIP, SMB, FTP, MSSQL and HTTP. The authors modified incident logging to emit one JSON record per incident for ingestion into Elastic Stack, then analyzed files on physically isolated machines.
This is useful as an architecture example: a sensor collects, structured events enter a SIEM, and malware analysis is physically separated. It is not evidence that every Dionaea installation has those five services, JSON format, Elastic integration or isolated analysis machines built in. The case study also does not establish a general capture-rate, detection-rate or effectiveness statistic for Dionaea.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How Dionaea compares with other honeypot approaches
There is no controlled head-to-head result in the available material that ranks Dionaea above another honeypot. Choose by the behavior you need to observe rather than by a generic claim that one product is “best.”
| Decision axis | Questions to ask about Dionaea | Why it matters |
|---|---|---|
| Protocol coverage | Does the build include the service attackers are targeting, and is it enabled? | A honeypot cannot observe an interaction it does not emulate or expose. |
| Interaction fidelity | Does the emulation support the negotiation and API sequence required before payload delivery? | Higher-fidelity exchanges can reveal activity that a simple banner or port listener misses. |
| Payload capture | Will the service interaction produce a retrievable file or only an incident record? | Collection goals determine storage, handling and analysis requirements. |
| Telemetry integration | Which handlers, processors and formats fit your SIEM or feed? | Useful events must arrive in a form analysts can search and retain. |
| Containment burden | Can you isolate, patch, monitor and rebuild the exposed host? | The sensor’s attack surface is part of its operating cost. |
| Maintenance and currency | Are the documentation and module contents appropriate for your current platform? | Protocol support and deployment instructions can change over time. |
Licensing and project currency
The official repository states that Dionaea is GPLv2 or later, with license exceptions for the TFTP module and parts of FTP. Anyone distributing modified software should inspect the relevant files and component terms rather than assuming one license statement covers every module.
The inspected documentation identifies itself as version 0.11.0 and calls the documentation a work in progress. The repository and its branches are mutable, so do not treat that documentation label as proof of the current release or assume that the module inventory is unchanged. Record the revision you deploy and review its accompanying documentation.
Free tools Windows power users keep installed
One-click scans. No signup required.
Common mistakes and recovery steps
Assuming every listed service is active
Check the running configuration and listening sockets. If an expected protocol is absent, verify the module was built, enabled and bound to the intended interface before interpreting the lack of incidents as a lack of attacks.
Best Value
Putting the sensor on a production subnet
Move it to an isolated network before collecting further traffic. Review routes, firewall rules, credentials and logs for any exposure that occurred during the mistake.
Running with excessive privileges
Apply privilege dropping and chroot as documented, then test file and log permissions. If the process cannot be constrained without breaking collection, redesign the deployment rather than accepting unrestricted access.
Letting samples land on analyst workstations
Quarantine the storage location, disable automatic execution and transfer only through the controlled analysis workflow. Preserve hashes and incident metadata so evidence remains attributable.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Treating missing events as proof of ineffectiveness
Check routing, DNS, firewall policy, listener state, rate limits, clock synchronization and logging delivery first. No general Dionaea capture-rate statistic is established by the cited material, so a quiet sensor needs operational diagnosis rather than a sweeping performance conclusion.
Bottom line
Dionaea is most useful when you need service-aware honeypot interactions and copies of malware delivered through them, especially SMB activity. Its broad module inventory, configurable logging and scripting architecture support research and detection pipelines, but supported modules are not automatically enabled and no universal effectiveness rate is established. Deploy it as an isolated, rebuildable collection system, reduce its privileges, and analyze captured files only in a separate malware laboratory.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
