Cowrie

7.0easy start · #4 of 18
in Honeypot Software

Free to practise onyes
Free trialnot on record
Well documentedyes
Runs where you worknot on record

Runs on Linux, self-hosted.

Visit site Alternatives

Cowrie is ranked #4 of 18 in honeypot software on The Geeks Club. It runs on Linux, Self-hosted. There is a free plan.

Cowrie plans and pricing

All plans

Cowrie Free Free and open-source SSH and Telnet honeypot · BSD licensed cowrie.org · 2 Oct 2026

Compared on honeypot software

Free plan: Yes
Deployment model: self-hosted
Decoy scope: multi-layer
Credential lures: Yes

Best Cowrie alternatives

See all 12

Beelzebub 0 of 4 in the starter kit Lesson 17.5 OpenCanary 0 of 4 in the starter kit Lesson 27.3 Canarytokens 0 of 4 in the starter kit Lesson 37.0 Heralding 0 of 4 in the starter kit Lesson 56.9 T-Pot 0 of 4 in the starter kit Lesson 66.9 Dionaea 0 of 4 in the starter kit Lesson 76.7

The record

What it does: Cowrie is a medium- to high-interaction SSH and Telnet honeypot designed to log brute-force attacks and attackers’ shell activity.
Emulated shell: Its default shell mode emulates a UNIX system in Python with a fake filesystem and does not run attackers’ commands on the real host.
Proxy mode: Proxy mode forwards SSH and Telnet sessions to another system while monitoring attacker behavior.
Session recording: Cowrie records terminal sessions with timing information for later replay using its playlog utility.
Malware capture: Cowrie saves files fetched with wget or curl and files uploaded with SFTP or SCP for later inspection.
Logging: Cowrie logs attacker activity as JSON, including logins, commands, downloads, TCP forwards and session metadata.
Integrations: Output plugins include Elasticsearch, Splunk, Microsoft Sentinel, MISP, VirusTotal, Slack, Discord, MySQL, PostgreSQL, SQLite, MongoDB, Graylog, Kafka, Prometheus, Datadog and Amazon S3.
LLM mode: An experimental LLM backend can generate dynamic shell responses and maintain conversation context across a session.
Deployment: Cowrie can be installed using pip, Docker or a Git checkout, and its documentation lists Python 3.11+ and python-virtualenv as local requirements.
Security boundary: The feature page says the emulated shell is safe to expose because commands run in a fake filesystem and do not touch the real host.
License and history: Cowrie is free and open source under a BSD license and began in 2014 as a fork of the Kippo honeypot.
Who maintains it: Cowrie is maintained by volunteers, and the project credits creator and maintainer Michel Oosterhof.
Intended users: The project says it is used by security researchers, CERTs and defenders around the world.
Support: The project links users to community Slack and Discord channels.
Price from: Free

Where it ranks on The Geeks Club

Best Honeypot Software in 2026#4 of 18

Is Cowrie yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote Cowrie

Sources

docs.cowrie.org/en/stable/README.html· checked 2 Oct 2026
cowrie.org/features/· checked 2 Oct 2026
cowrie.org· checked 2 Oct 2026
cowrie.org/integrations/· checked 2 Oct 2026
cowrie.org/about/· checked 2 Oct 2026