- Home
- Honeypot Software
- Honeyd
Honeyd
What it is
Honeyd is a self-hosted daemon for building virtual hosts and honeypots on a network. Its stated uses include threat detection and assessment, network simulation, virtual honeynets, and general monitoring. One machine can claim up to 65,536 IP addresses, and Honeyd can simulate thousands of hosts at once. Configured hosts can provide arbitrary services or proxy them to another machine. Honeyd can alter TCP/IP behavior to imitate operating-system personalities recognizable by Nmap or Xprobe. It also supports virtual routing topologies with adjustable latency, packet loss, asymmetric routes, physical hosts, and GRE tunnels. Its flow-log option records connections and packets, including protocol and connection details. Honeyd does not direct network traffic to itself automatically; users must route traffic using routing, proxy ARP, or arpd. The project is free under the GNU General Public License. The download page says it should compile and run on *BSD, GNU/Linux, and Solaris, and the FAQ describes a Windows port of Honeyd 0.5. The latest listed release is Honeyd 1.5c from 2007-05-27. The maker recommends sandboxing it with Systrace because it interacts with potentially malicious adversaries and scripts.
For and against
For
- Can simulate thousands of virtual hosts.
- Supports configurable routing topologies and GRE tunnels.
- Flow logs record connection and packet details.
- Free and released under the GNU General Public License.
Against
- Traffic must be directed to Honeyd manually.
- The latest listed release dates to 2007.
- Maker recommends sandboxing it with Systrace.
- Windows information describes a port of version 0.5.
The verdict
Honeyd offers extensive network simulation and honeypot configuration, but it requires users to arrange traffic routing and heed the maker’s sandboxing guidance. Its latest listed release is dated 2007-05-27.
Who it suits
Honeyd suits users creating host- or network-based honeypots, virtual honeynets, or network monitoring setups. It is intended for people able to direct network traffic to a self-hosted service.
Plans and prices
Honeyd
Distributed free of charge; GPL-licensed
Read 7 Oct 2026 · honeyd.org
On the record
- Integrations
- The project documents Nmap and Xprobe fingerprinting, GRE tunneling, and dependencies on libevent, libdnet, and libpcap.honeyd.org · read 7 Oct 2026
- Intended users
- The maker describes Honeyd for creating host-based and network-based virtual honeypots, virtual honeynets, and general network monitoring.honeyd.org · read 7 Oct 2026
- Latest listed release
- The maker's releases page lists Honeyd 1.5c, released 2007-05-27, as its latest release.honeyd.org · read 7 Oct 2026
- License
- Honeyd is open source software released under the GNU General Public License.honeyd.org · read 7 Oct 2026
- Logging
- Honeyd's -l option creates a flow log for connections and packets, including protocol, connection details, and passive OS identification comments.honeyd.org · read 7 Oct 2026
- Network simulation
- It supports virtual routing topologies with configurable latency, packet loss, asymmetric routes, physical hosts, and GRE tunnels.honeyd.org · read 7 Oct 2026
- OS emulation
- Honeyd adapts TCP/IP behavior to emulate operating system personalities that Nmap or Xprobe can identify.honeyd.org · read 7 Oct 2026
- Platform support
- The download page says Honeyd should compile and run on *BSD, GNU/Linux, and Solaris; the FAQ also describes a Windows port of Honeyd 0.5.honeyd.org · read 7 Oct 2026
- Purpose
- Honeyd is a daemon for creating virtual hosts and honeypots on a network for threat detection, assessment, and network simulation.honeyd.org · read 7 Oct 2026
- Security guidance
- The maker recommends sandboxing Honeyd with Systrace because it interacts with potentially malicious adversaries and scripts.honeyd.org · read 7 Oct 2026
- Services
- Hosts can simulate arbitrary services from configuration files or proxy services to another machine.honeyd.org · read 7 Oct 2026
- Support
- The FAQ invites users whose questions are unanswered to contact the maintainer by email.honeyd.org · read 7 Oct 2026
- Traffic setup
- Honeyd does not intercept network traffic automatically; users must direct traffic to it using routing, proxy ARP, or arpd.honeyd.org · read 7 Oct 2026
- Virtual hosts
- A single host can claim as many as 65,536 IP addresses, and Honeyd can simulate thousands of virtual hosts at once.honeyd.org · read 7 Oct 2026
