How to Set Up a Home Network Honeypot to Detect Attackers

Firewalls and intrusion detection systems tell you about traffic hitting real, legitimate services — but what about connections aimed at things that shouldn’t exist at all? A home network honeypot flips that question around, deploying a decoy service designed purely to attract and log unauthorized access attempts, giving you clear, unambiguous evidence that something is probing your network.

What Is a Honeypot?

A honeypot is a deliberately exposed, fake service or system designed to look like a legitimate target — an SSH server, a database, a web login page — with no real purpose other than attracting attackers and recording everything they do. Since no legitimate user or automated process should ever have a reason to connect to it, any interaction with a honeypot is inherently suspicious, eliminating the false-positive noise that plagues traditional intrusion detection.

Why Run a Honeypot at Home?

• Zero false positives – nobody legitimate should ever touch a honeypot, so every logged interaction is a genuine signal worth investigating
• Early warning system – detect reconnaissance and scanning activity happening on your network before an attacker finds a real vulnerable service
• Learning tool – observe actual attack techniques and tools in a safe, contained way, valuable for anyone building security skills
• Threat intelligence – logged attacker IPs and techniques can feed directly into your firewall or Fail2Ban blocklists

Introducing Cowrie

Cowrie is a popular, free, open-source SSH and Telnet honeypot that simulates a realistic-looking Linux shell environment, logging every command an attacker attempts to run without actually executing anything against your real system.

Installing Cowrie

Cowrie requires Python and is typically installed in a dedicated virtual environment:

git clone https://github.com/cowrie/cowrie.git
cd cowrie
python3 -m venv cowrie-env
source cowrie-env/bin/activate
pip install -r requirements.txt

Configuring Cowrie

Copy the default configuration template and adjust it to your needs:

cp etc/cowrie.cfg.dist etc/cowrie.cfg

Key settings to review include the fake hostname displayed to attackers, the emulated shell prompt, and which ports Cowrie listens on (commonly configured to listen on the standard SSH port 22 while your real SSH service is moved to a non-standard port, as covered in earlier SSH hardening).

Starting Cowrie

bin/cowrie start

Reviewing Captured Activity

Cowrie logs every session in detail, including attempted usernames, passwords, and any commands run inside the fake shell, stored in var/log/cowrie/cowrie.json. Reviewing these logs reveals exactly what automated bots and opportunistic attackers attempt once they gain apparent access — commonly downloading malware, attempting to add persistence, or scanning for other reachable systems.

Isolating Your Honeypot

A honeypot should never share a network segment with anything sensitive. Deploy it on an isolated VLAN (as covered in the earlier VLAN segmentation guide) with no route to your real internal services, ensuring that even if an attacker somehow escapes the honeypot’s contained environment, they land in a dead-end network with nothing valuable to reach.

Feeding Honeypot Data into Fail2Ban

Since any connection attempt to a honeypot is inherently malicious, you can configure Fail2Ban to watch Cowrie’s logs and immediately ban any IP address that interacts with it at all — a far more aggressive and confident blocking policy than what’s reasonable for a real service’s failed login logs.

Legal and Ethical Considerations

Running a honeypot on your own network to observe incoming attack attempts is standard, legitimate security practice. However, never use captured attacker techniques, credentials, or tools against third parties — the honeypot’s value is purely defensive observation, not a launching point for retaliation.

Final Thoughts

Setting up a home network honeypot gives you unambiguous, high-confidence visibility into who’s actually probing your network, without the noise and false positives that come with monitoring legitimate services. Combined with Fail2Ban, Suricata, and proper network segmentation, a honeypot rounds out a genuinely comprehensive home network security posture.