1

Troubleshooting

anti edited this page 2026-04-18 06:07:29 -04:00

Table of Contents

• Troubleshooting
• Networking
• MACVLAN fails on WSL
• NIC not in promiscuous mode
• Auth and Startup
• admin/admin rejected at startup
• JWT secret too short
• Embedded vs Standalone Workers
• Python Runtime
• Python 3.14 GC instability under load
• Database
• SQLite write contention

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

Troubleshooting

Common gotchas when deploying and running DECNET.

Networking

MACVLAN fails on WSL

WSL does not play nicely with MACVLAN drivers. Options:

• Run DECNET on bare metal or inside a proper VM (preferred).
• Fall back to IPVLAN by passing --ipvlan on the deploy command.

See Home for supported environments.

NIC not in promiscuous mode

Deckies and the sniffer need the host NIC in promiscuous mode to see decoy-directed traffic. If captures look empty:

sudo ip link set <iface> promisc on

Auth and Startup

admin/admin rejected at startup

Intentional. DECNET refuses to boot with the trivial default. Set DECNET_ADMIN_USER and DECNET_ADMIN_PASSWORD to real values.

JWT secret too short

DECNET_JWT_SECRET must be at least 32 bytes for HS256 (RFC 7518 §3.2). Shorter secrets are rejected at startup with an explicit error. See decnet/env.py.

Embedded vs Standalone Workers

Running both the embedded profiler/sniffer and a standalone instance causes duplicate or skipped events.

Fix: pick one. Unset the embed flags when running standalone workers:

unset DECNET_EMBED_PROFILER
unset DECNET_EMBED_SNIFFER

See Environment-Variables.

Python Runtime

Python 3.14 GC instability under load

The 3.14 GC has surfaced crashes under DECNET's load profile. Pin to Python 3.11 – 3.13 until upstream stabilizes.

Database

SQLite write contention

Under heavy concurrent event ingestion, SQLite can hit writer-lock contention. Switch the backend to MySQL.

See Database-Drivers.

---

See also: Security-and-Stealth · Environment-Variables · Roadmap-and-Known-Debt

DECNET

• Home

User docs

• Quick-Start
• Installation
• Requirements-and-Python-Versions
• CLI-Reference
• INI-Config-Format
• Custom-Services
• Services-Catalog
• Service-Personas
• Archetypes
• Distro-Profiles
• OS-Fingerprint-Spoofing
• Networking-MACVLAN-IPVLAN
• Deployment-Modes
• SWARM-Mode
• MazeNET
• Remote-Updates
• Environment-Variables
• Teardown-and-State
• Database-Drivers
• Systemd-Setup
• Logging-and-Syslog
• Service-Bus
• Web-Dashboard
• REST-API-Reference
• Mutation-and-Randomization
• Troubleshooting

Developer docs

• Developer-Guide
• Design-Overview
• Writing-a-Service-Plugin
• UI-Things
• Module-Reference-Core
• Module-Reference-Web
• Module-Reference-Services
• Module-Reference-Workers
• PKI-and-mTLS
• Testing-and-CI
• Performance-Story
• Tracing-and-Profiling

Project meta

• Sponsors
• Support-the-Project
• Security-and-Stealth
• Roadmap-and-Known-Debt

DECNET — honeypot deception-network framework. Pre-1.0, active development — use with caution. See Sponsors to support the project. Contact: samuel@securejump.cl