Protocol Honeypots
Detect credential theft and lateral movement by deploying fake database and service credentials.
How Protocol Honeypots Work
Protocol honeypots create realistic-looking credentials for common database and service protocols. When an attacker discovers and attempts to use these credentials, the connection attempt is detected and you receive an alert.
Detection Flow
Available Protocols
Tripwires supports the following protocol honeypots. Administrators can see the live coverage list — every emulated protocol plus the notable protocols not yet covered — under Admin → Honeypots (the same set ships on self-hosted and SaaS).
ICS / SCADA: Modbus (port 502) and Siemens S7comm (port 102) are emulated — a probe is answered like a live PLC while the unit/function code, register address, and (for S7) the targeted rack and slot are captured.
Known gaps (not yet emulated): DNS server, SNMP, NTP, IMAP/POP3, the Kubernetes API, SIP/VoIP, MQTT, and DNP3.
Databases
PostgreSQL
Most popular open-source database. Port 5432.
MySQL
World's most popular database. Port 3306.
MSSQL
Microsoft SQL Server for enterprise. Port 1433.
Elasticsearch
Distributed search and analytics engine. Port 9200.
MongoDB
Popular NoSQL document database. Port 27017.
Redis
In-memory data store and cache. Port 6379.
Memcached
Distributed memory caching system. Port 11211.
Remote Access
SSH
Secure remote server access. Port 22.
Telnet
Legacy remote access for network gear. Port 23.
RDP
Microsoft Remote Desktop Protocol. Port 3389.
VNC
VNC remote desktop access. Port 5900.
Network Services
LDAP
Enterprise directory services. Port 389.
SMB
Windows file sharing protocol. Port 445.
SMTP
Email sending protocol. Port 25/587.
FTP
File Transfer Protocol for legacy systems. Port 21.
Docker API
Docker daemon remote API. Port 2375.
HTTP Admin
HTTP admin panels and dashboards. Port 8080.
ICS / SCADA
Modbus
Industrial control protocol. Answers reads/writes like a live PLC and captures the unit id, function code and register address probed. Port 502.
Siemens S7
S7comm over ISO-on-TCP. Confirms the connection like a real SIMATIC PLC and captures the source/destination TSAP, including the targeted rack and slot. Port 102.
Coming Soon
We're constantly expanding our protocol support. The following honeypots are coming soon:
What Gets Detected
When someone attempts to connect using your honeypot credentials, Tripwires captures:
- Source IP address - Where the connection came from
- Timestamp - Exact time of the connection attempt
- Username used - The username in the connection attempt
- Protocol details - Additional protocol-specific information
Choosing the Right Protocol
Select protocols that match your actual infrastructure to make the honeypot credentials believable:
| If you use... | Create honeypots for... |
|---|---|
| PostgreSQL or MySQL databases | PostgreSQL / MySQL (looks like backup/staging DB) |
| Microsoft SQL Server | MSSQL (looks like ERP or reporting DB) |
| Redis or Memcached for caching | Redis / Memcached (looks like session store) |
| ELK stack or MongoDB | Elasticsearch / MongoDB (looks like log archive or data store) |
| SSH for server access | SSH (looks like jump server or bastion host) |
| Remote desktop (Windows) | RDP / VNC (looks like admin workstation) |
| Active Directory or LDAP | LDAP (looks like corporate directory) |
| Windows file shares | SMB (looks like finance or HR share) |
| Docker containers | Docker API (looks like container registry) |
| Web admin panels | HTTP Admin (looks like admin dashboard) |
| Legacy file transfers or email | FTP / SMTP (looks like backup or mail server) |
| Network equipment (switches, IoT) | Telnet (looks like network management interface) |
Pro Tip
Create multiple honeypots of the same type with different names to catch attackers at various points in your infrastructure.