- Home
- Honeypot Software
- Dionaea
Dionaea
What it is
Dionaea is a free, self-hosted Linux honeypot designed to capture malware that targets network services. Its goal is to obtain a copy of malicious software attempting to exploit those services. The project embeds Python and uses libemu to identify shellcode. Dionaea can expose services over TCP, UDP, and TLS for IPv4 and IPv6, with listed protocols including FTP, HTTP, MQTT, MSSQL, MySQL, SIP, SMB, TFTP, and UPnP. Incident handlers can route selected information to JSON, SQLite, SQL, or hpfeeds, and the documentation describes using JSON logs with ELK to collect and visualize attack activity. It is available as source code and an official Docker image. Installation guidance recommends Ubuntu 18.04 LTS or Debian 10 with Python 3.9 or 3.8, while noting libemu package availability concerns for Ubuntu 20.04 and Debian 11. The project warns that Dionaea may contain exploitable bugs; privilege dropping and chroot can reduce potential impact.
For and against
For
- Free and open source under GPLv2+.
- Supports TCP, UDP, and TLS services.
- Offers a broad set of listed network protocols.
- Routes incident details to JSON, SQLite, SQL, or hpfeeds.
- An official Docker image is available.
Against
- The project warns it may contain exploitable bugs.
- Installation guidance recommends older Ubuntu or Debian releases.
- DionaeaFR is marked unmaintained since 2014.
The verdict
Dionaea offers network-service coverage and multiple routes for recording incident details at no cost. Its security warning and older installation guidance are important considerations for a self-hosted setup.
Who it suits
Dionaea suits Linux administrators and incident handlers who want to observe malware activity against network services. It requires a self-hosted deployment and attention to the project's security and installation cautions.
Plans and prices
Dionaea
Open-source honeypot; GPLv2+
Read 4 Oct 2026 · github.com
On the record
- Connection controls
- Dionaea can apply rate and accounting limits to TCP and TLS connections when required.dionaea.readthedocs.io · read 4 Oct 2026
- Deployment
- The project provides an official Docker image and source code downloads from its release page or Git repository.dionaea.readthedocs.io · read 4 Oct 2026
- Documented systems
- Installation guidance recommends Ubuntu 18.04 LTS or Debian 10 and Python 3.9 or 3.8; it cautions against Ubuntu 20.04 and Debian 11 due to libemu package availability at the time of writing.dionaea.readthedocs.io · read 4 Oct 2026
- Honeypot platform
- The DTAG Community Honeypot Project maintains T-Pot, a multi-honeypot platform that includes Dionaea.dionaea.readthedocs.io · read 4 Oct 2026
- Integrations
- The documentation describes using log_json with the ELK stack to collect, aggregate, and visualize attack information.dionaea.readthedocs.io · read 4 Oct 2026
- Legacy integration
- The DionaeaFR web frontend displays attack information using Dionaea's SQLite database, and the documentation marks it unmaintained since 2014.dionaea.readthedocs.io · read 4 Oct 2026
- License
- The repository lists Dionaea as GPLv2+, with a TFTP service under the CNRI Python License and parts of FTP under MIT.github.com · read 4 Oct 2026
- Logging
- Incident handlers can route selected incident information into formats such as JSON, SQLite, SQL, and hpfeeds.dionaea.readthedocs.io · read 4 Oct 2026
- Network support
- Dionaea can offer services over TCP, UDP, and TLS for IPv4 and IPv6.dionaea.readthedocs.io · read 4 Oct 2026
- Protocols
- Listed services include FTP, HTTP, MQTT, MSSQL, MySQL, SIP, SMB, TFTP, and UPnP.github.com · read 4 Oct 2026
- Purpose
- Dionaea is a honeypot intended to trap malware exploiting network services, with the goal of obtaining a copy of the malware.dionaea.readthedocs.io · read 4 Oct 2026
- Security
- The documentation says Dionaea may contain exploitable bugs and can drop privileges and chroot to reduce potential impact.dionaea.readthedocs.io · read 4 Oct 2026
- Shellcode detection
- The project describes Dionaea as embedding Python and using libemu to detect shellcode.github.com · read 4 Oct 2026
- Support
- The documentation directs users to the GitHub issue tracker for problems and also mentions mailing-list and IRC support channels.dionaea.readthedocs.io · read 4 Oct 2026
