DECNET Wiki

⚠ Pre-1.0 — use with caution. DECNET is under active development and has not yet cut a v1.0 release. The test suite currently covers more than 1,900 cases, but expect bugs in the corners we haven't probed and expect features to land, shift, and occasionally break between versions. Do not deploy against production adversaries without reading the code you're trusting, and pin to a known commit if you need stability.

DECNET is a honeypot deception-network framework that spins up fleets of fake machines (deckies) running realistic services (RDP, SMB, SSH, FTP, HTTP, and more) to lure, observe, and profile attackers. Every interaction is funnelled to an isolated logging network (syslog/ELK/SIEM) so the real infrastructure stays silent while the decoys do the talking. It runs on a single host (UNIHOST) or across a swarm, with container-level OS fingerprint spoofing and per-service personas.

Start here

New to DECNET? Read Quick-Start.
Setting up a host from scratch? Read Installation and Requirements-and-Python-Versions.
Looking up a flag? See CLI-Reference.

Supported Python: 3.11, 3.12, 3.13. Python 3.14 is not supported — its new garbage collector breaks DECNET under load. See Requirements-and-Python-Versions.

User docs

Developer docs

Project meta

DECNET

Home

User docs

Developer docs

Project meta

DECNET — honeypot deception-network framework. Pre-1.0, active development — use with caution. See Sponsors to support the project. Contact: samuel@securejump.cl