What is the most robust solution for a super-simple linux daemon that just LISTENS on some port(s) and every time a connection is ESTABLISHED, it immediately sends me an email alert?

I'm building a low-interaction honeypot inside my production network. I found that most of the open-source "honeypot" solutions are way more complex than what I need.

I just want a simple daemon to listen on some "valuable" ports (eg 22, 139, 3389, 5900, etc) and send me an email alert if anything connects to it.

Valid solutions could be to use a an open-source project already available, or to just a simple bash/perl/python script -- as long as it can be daemonized to a service that will start on boot.

  • 1
    Use iptables to log SYN packets and then alert on log entries. – AlexD Feb 8 at 16:20
  • This is a great resource that lists lots of honeypot-related projects github.com/paralax/awesome-honeypots – Michael Altfield Feb 8 at 16:31
  • That sounds like a great way to spam-dos yourself. The honey trapper trapped itself – Uncle Billy Feb 8 at 16:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.