Telnet Honeypot Enterprise Community

The Telnet service emulates a Telnet-enabled device and captures login attempts. Telnet is still widely used on network equipment, IoT devices and legacy systems - making it a valuable honeypot target.

Configuration

"telnet": [
  {
    "port": 2323,
    "version": "Cisco router telnetd / IOS",
    "hostname": "router"
  }
]

Parameters

Parameter	Type	Default	Description
port	integer	23	TCP port
version	string	Cisco router telnetd / IOS	Device profile - selects greeting, failure text, and prompt mode
hostname	string	router	Substituted for {hostname} in profiles that use it

Banner examples

D-Link DSL router
Cisco IOS
Juniper Networks router
HP ProCurve Switch
MikroTik RouterOS

What gets captured

Event	Fields
Connection made	Source IP and port
Data sent	Telnet option negotiation bytes
Login attempt	Username and password (password-only profiles log an empty username)