A low-interaction honeypot that responds to network scanners and bots across multiple protocols, designed for self-hosted threat intelligence.
Masscanned is a low-interaction honeypot that responds to network scanners and bots across multiple protocols. It simulates real network services to capture scanning activity and gather threat intelligence. The project implements its own userland network stack to provide generic responses with minimal assumptions about client behavior.
Security researchers, network administrators, and threat intelligence teams who need to monitor scanning activity and build self-hosted security monitoring infrastructure.
Developers choose Masscanned for its extensive protocol support, lightweight design, and seamless integration with IVRE for analysis. It provides a privacy-preserving, self-hosted alternative to commercial threat intelligence services.
Let's be scanned. A low-interaction honeypot focused on network scanners and bots. It integrates very well with IVRE to build a self-hosted alternative to GreyNoise.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Supports ARP, ICMP, TCP, UDP, HTTP, SSH, STUN, SMB, and DNS, enabling interaction with a wide range of network scanners and bots as detailed in the protocol list.
Minimal interaction design responds to probes without running actual services, reducing attack surface and resource usage, which is core to its philosophy.
Designed to work with IVRE for network reconnaissance data analysis, allowing captured traffic to be easily processed for threat intelligence.
Provides extensive logs of received, sent, and dropped packets with verbosity controls, aiding in forensic analysis and monitoring.
Can be deployed on VPS or locally with Docker support, offering privacy and control over data without relying on external services.
Only provides generic responses (e.g., HTTP 401 for all verbs, basic DNS answers), lacking advanced simulation that might fail to engage sophisticated scanners.
Requires manual configuration of network namespaces, veth interfaces, or Docker with NET_ADMIN capabilities, which can be daunting for non-experts as shown in the setup examples.
Admits shortcomings in the 'To Do' section, such as not dropping packets with incorrect checksums or fixing source addresses for multicast, reducing realism.
Primarily optimized for passive intelligence gathering from scanners, not for active defense, high-fidelity honeypots, or real service emulation.
Masscanned is an open-source alternative to the following products: