Let’s build a simple, practical Linux port‑scan honeypot that uses iptables to capture/redirect incoming connection attempts and simple listeners that log interaction, and use nmap to test it. I’ll give runnable commands, a small Python honeypot listener, iptables rules (with rate‑limited logging), how to test with nmap, and notes on analysis, hardening, and safety.
Important safety notes (read first)
- Only deploy this on machines/networks you own or are explicitly authorized to test. Scanning other people’s systems or letting an exposed honeypot be used to attack others is illegal and unethical.
- Run the honeypot inside an isolated VM or protected network segment (use separate host or VLAN), and don't forward traffic from other networks unless you understand the risks.
- Keep logs rotated and watch disk usage — honeypots can attract high traffic.
Overview
- Prepare an isolated Linux VM.
- Add iptables rules to log and optionally redirect connection attempts to local listeners.
- Run simple service emulators (Python) to accept connections and log data.
- Use nmap to test and validate behavior.
- Collect, parse, and analyze logs; optionally integrate with syslog/ELK.
Setup assumptions
- Ubuntu/Debian or similar Linux.
- Root (sudo) access.
- iptables, python3, nmap, and socat/netcat available (I’ll show alternatives).
1) Create a safe environment
- Use a VM (VirtualBox/QEMU/KVM) or container with no sensitive data.
- Give it a fixed private IP on an isolated network.
- Optionally place the VM behind another firewall (so you can control exposure).
2) Simple iptables logging rules (filter table)
We want to log connection attempts but avoid log flooding by using limit. Put these commands in a root shell:
# create a honeypot chain
# iptables -N HONEY
# rate-limited LOG then return so traffic continues to normal behavior
# iptables -A HONEY -m limit –limit 5/min –limit-burst 10 -j LOG \
–log-prefix "HPOT_CONN: " –log-level 4
# record raw packets to kernel log (optional NFLOG/ulogd is better for high volume)
# allow the packet to continue (or drop if you want it to appear closed)
# iptables -A HONEY -j ACCEPT
# Apply HONEY chain to incoming TCP attempts to all ports (or a subset)
# iptables -A INPUT -p tcp -j HONEY
Notes:
- This logs packets hitting INPUT. If your VM is behind NAT or you want to catch forwarded packets, apply to FORWARD too.
- Using -j LOG writes to kernel log, often /var/log/kern.log or via rsyslog to /var/log/messages.
- Use NFLOG (-j NFLOG) with ulogd if you want structured logging and higher throughput.
If you prefer to log only SYNs (new connection attempts) to reduce noise:
# iptables -A HONEY -p tcp –syn -m limit –limit 5/min –limit-burst 10 \
-j LOG –log-prefix "HPOT_SYN: " –log-level 4
If you want to redirect certain destination ports into local port listeners (so local fake services can accept connections), use the nat table PREROUTING:
# Example redirect incoming port 80 to local port 8080
# iptables -t nat -A PREROUTING -p tcp –dport 80 -j REDIRECT –to-ports 8080
# For ports other than 80/443, add other rules
# iptables -t nat -A PREROUTING -p tcp –dport 22 -j REDIRECT –to-ports 2222
Notes:
- -t nat -A PREROUTING catches traffic before routing. Use OUTPUT if traffic originates on host itself.
- REDIRECT only works for local listeners.
3) Simple Python multi‑port honeypot listener
This script will bind multiple ports and log incoming connections and first bytes (banner or payload). Save as simple_honeypot.py:
#!/usr/bin/env python3
# simple_honeypot.py
import socket, threading, logging, time
LISTEN_PORTS = [22, 80, 443, 8080, 2222] # customize
BANNER = b"HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\nOK"
logging.basicConfig(
filename="/var/log/honeypot.log",
level=logging.INFO,
format="%(asctime)s %(message)s"
)
def handle_client(conn, addr, port):
try:
conn.settimeout(5.0)
data = conn.recv(4096)
logged = data[:100].decode('utf-8', errors='replace')
logging.info("CONNECT %s:%s -> port=%d first=%s", addr[0], addr[1], port, logged)
# Send a small believable banner depending on port
if port in (80, 8080):
conn.sendall(BANNER)
elif port in (22, 2222):
conn.sendall(b"SSH-2.0-OpenSSH_7.4p1\r\n")
else:
conn.sendall(b"220 smtp.example.com ESMTP\r\n")
except Exception as e:
logging.info("ERROR %s", e)
finally:
try:
conn.close()
except:
pass
def start_listener(port):
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
s.bind(('0.0.0.0', port))
s.listen(50)
logging.info("Listening on %d", port)
while True:
conn, addr = s.accept()
t = threading.Thread(target=handle_client, args=(conn, addr, port), daemon=True)
t.start()
if __name__ == "__main__":
for p in LISTEN_PORTS:
t = threading.Thread(target=start_listener, args=(p,), daemon=True)
t.start()
# keep alive
while True:
time.sleep(3600)
Run it as root (or with capability binding) so it can listen on low ports:
# python3 simple_honeypot.py
# check logs
# tail -F /var/log/honeypot.log
Alternatives:
- Use socat to spawn a logger for individual ports.
- Use cowrie, glastopf, honeyd, sshpot etc. if you want full featured honeypots.
4) Using nmap to test the honeypot
Only scan your honeypot IP. Example commands:
Basic TCP port scan:
# nmap -sS -p- -T4 -oN scan_ports.txt <HONEYPOT_IP>
Service/version detection:
# nmap -sV -sC -p 22,80,443,2222 -oN scan_svcs.txt <HONEYPOT_IP>
Scan while avoiding ping (if your VM blocks ICMP):
# nmap -Pn -sS -p1-2000 <HONEYPOT_IP>
Aggressive scan + scripts (use on your own host only):
# nmap -A -T4 <HONEYPOT_IP>
Watch your honeypot logs while scanning to confirm entries.
5) Log collection & analysis
- Kernel log: sudo tail -F /var/log/kern.log or sudo journalctl -f
- Python listener log: /var/log/honeypot.log
- For structured logging and higher throughput: configure ulogd (NFLOG) or forward logs to syslog/rsyslog and ELK/Graylog.
- Example simple grep: grep HPOT_CONN /var/log/kern.log | tail -n 200
6) Hardening & operational tips
- Isolate honeypot inside a VM and snapshot it so you can revert.
- Use rate limits in iptables to avoid log flooding: -m limit –limit 5/min.
- Rotate logs: configure logrotate for /var/log/honeypot.log.
- Do not allow outbound traffic from the honeypot unless needed – attackers may use it to pivot. Use egress firewall rules to restrict outbound connections.
- Consider running the honeypot under an unprivileged user wherever possible.
- If expecting a lot of traffic, use NFLOG + ulogd or suricata/zeek for more scalable capture.
7) Optional: Richer visibility with NFLOG / ulogd
If you anticipate higher volume or want structured logs, use:
# example: mark packets from all TCP and send to NFLOG group 1
# iptables -I INPUT -p tcp -m limit –limit 10/min -j NFLOG –nflog-group 1
# run ulogd to write NFLOG to a file or DB (configure /etc/ulogd.conf)
8) Example scenario — bring it all together
- Start VM and ensure IP 192.168.56.101.
- Add iptables logging and redirect HTTP->8080.
- Run simple_honeypot.py with ports [22,80,2222,8080].
- From your scanner machine: nmap -sS -sV -p22,80,2222,8080 192.168.56.101
- Watch /var/log/honeypot.log and kernel logs for HPOT_* prefixes to see connections and payloads.
Quick reference for commands used:
- Create honeypot chain and log SYNs:
# iptables -N HONEY
# iptables -A HONEY -p tcp –syn -m limit –limit 5/min –limit-burst 10 \
-j LOG –log-prefix "HPOT_SYN: "
# iptables -A INPUT -p tcp -j HONEY
- Redirect port 80 -> 8080
# iptables -t nat -A PREROUTING -p tcp –dport 80 -j REDIRECT –to-ports 8080
- Run listener:
# python3 simple_honeypot.py
- Test with nmap:
# nmap -sS -sV -p22,80,2222,8080 -Pn <IP>
Conclusion
Building a simple Linux port‑scan honeypot with iptables and lightweight listeners gives you practical, immediate visibility into who’s probing your network and how they probe. With a few well‑scoped iptables rules you can capture and rate‑limit connection attempts, redirect selected ports to local emulators, and keep tidy, analysable logs. The small Python listener shown is enough to collect banners and initial payloads; for higher volume or more fidelity you can step up to NFLOG / ulogd, Zeek / Suricata, or production honeypots like Cowrie.
Remember the two rules that keep a honeypot useful and safe: isolate it (VMs, VLANs, strict egress rules) and log thoughtfully (rate limits, rotation, structured formats). That protects your environment and makes the data you collect far more valuable. Over time, turn raw logs into indicators (IP reputations, patterns of ports/probes, common payloads) and feed them into alerts or dashboards to turn passive observation into active defense.
