- Home
- Honeypot Software
- T-Pot
T-Pot
What it is
T-Pot is a free, self-hosted honeypot platform for setting up multiple decoys and monitoring activity. It supports more than 20 honeypots and can run as a standalone system or as a distributed deployment with hive and sensor roles. Elasticsearch stores events, Logstash handles their ingestion and delivery, and Kibana provides dashboards. Included network monitoring tools include Fatt, P0f, and Suricata; other components include an animated attack map, CyberChef, Elasticvue, and Spiderfoot. The project documents supported Linux distributions. macOS and Windows use Docker Desktop and have a limited feature set. Recommended hardware is 16 GB RAM and a 256 GB SSD for a hive, or 8 GB RAM and a 128 GB SSD for a sensor. Data is sent to Sicherheitstacho by default, though the project describes how to disable that behavior. T-Pot is provided without a support commitment, and the project warns that compromise cannot be ruled out. It advises against placing sensitive data on honeypots. The listed plan is free; hardware and network requirements apply.
For and against
For
- Free, self-hosted plan.
- Supports more than 20 honeypots.
- Standalone and distributed deployment options.
- Includes event dashboards and network monitoring tools.
Against
- macOS and Windows have a limited feature set.
- Recommended hive hardware is 16 GB RAM and 256 GB SSD.
- Data is submitted to Sicherheitstacho by default.
- No support commitment is provided.
The verdict
T-Pot combines multiple honeypots with event analysis and monitoring tools in a self-hosted package. Consider its hardware needs, default data sharing, and security caveats before deployment.
Who it suits
T-Pot suits users who can host and manage honeypot infrastructure and want multiple decoys with event dashboards and network monitoring. Its limited macOS and Windows feature set may matter to users not deploying on documented Linux distributions.
Plans and prices
T-Pot
open source · self-hosted · hardware and network requirements apply
Read 4 Oct 2026 · github.com
On the record
- Analysis stack
- It uses Elasticsearch to store events, Logstash to ingest and send them, and Kibana to display dashboards.github.com · read 4 Oct 2026
- Data sharing
- By default, data is submitted to Sicherheitstacho, and the project says this can be disabled by removing the ewsposter section from the configuration.github.com · read 4 Oct 2026
- Deployment
- T-Pot supports standalone and distributed deployments, including hive and sensor installation types.github.com · read 4 Oct 2026
- Hardware requirements
- The project recommends 16 GB RAM and a 256 GB SSD for a hive, or 8 GB RAM and a 128 GB SSD for a sensor.github.com · read 4 Oct 2026
- LLM honeypots
- The Beelzebub and Galah honeypots require Ollama, while ChatGPT support is described as untested with T-Pot.github.com · read 4 Oct 2026
- Network monitoring
- Included network security monitoring tools include Fatt, P0f, and Suricata.github.com · read 4 Oct 2026
- Operating systems
- The project documents supported Linux distributions and says macOS and Windows use Docker Desktop with a limited feature set.github.com · read 4 Oct 2026
- Purpose
- T-Pot is an all-in-one, optionally distributed honeypot platform supporting multiple architectures and more than 20 honeypots.github.com · read 4 Oct 2026
- Retention
- Log persistence defaults to 30 cycles and the default Elasticsearch index policy keeps indices for 30 days; both can be adjusted.github.com · read 4 Oct 2026
- Security considerations
- The project warns that compromise cannot be ruled out and says honeypots should not contain sensitive data.github.com · read 4 Oct 2026
- Support
- T-Pot is provided as-is without a support commitment; users can report issues and ask general questions through GitHub Issues and Discussions.github.com · read 4 Oct 2026
- Visualization and tools
- Included tools include an animated attack map, CyberChef, Elasticvue, and Spiderfoot.github.com · read 4 Oct 2026
- Vulnerability reporting
- The security policy asks reporters to identify the affected component, provide reproduction details, and check whether the issue is known upstream.github.com · read 4 Oct 2026
