T-Pot

6.9easy start · #6 of 18
in Honeypot Software

Free to practise onyes
Free trialnot on record
Well documentedyes
Runs where you workyes

Runs on Linux, Mac, self-hosted, Windows.

T-Pot is ranked #6 of 18 in honeypot software on The Geeks Club. It runs on Linux, macOS, Self-hosted, Windows. There is a free plan.

T-Pot plans and pricing

All plans

T-Pot Free open source · self-hosted · hardware and network requirements apply github.com · 4 Oct 2026

Compared on honeypot software

Free plan: Yes
Deployment model: self-hosted
Decoy scope: multi-layer

Best T-Pot alternatives

See all 12

Beelzebub 0 of 4 in the starter kit Lesson 17.5 OpenCanary 0 of 4 in the starter kit Lesson 27.3 Canarytokens 0 of 4 in the starter kit Lesson 37.0 Cowrie 0 of 4 in the starter kit Lesson 47.0 Heralding 0 of 4 in the starter kit Lesson 56.9 Dionaea 0 of 4 in the starter kit Lesson 76.7

The record

Purpose: T-Pot is an all-in-one, optionally distributed honeypot platform supporting multiple architectures and more than 20 honeypots.
Analysis stack: It uses Elasticsearch to store events, Logstash to ingest and send them, and Kibana to display dashboards.
Network monitoring: Included network security monitoring tools include Fatt, P0f, and Suricata.
Visualization and tools: Included tools include an animated attack map, CyberChef, Elasticvue, and Spiderfoot.
Deployment: T-Pot supports standalone and distributed deployments, including hive and sensor installation types.
Operating systems: The project documents supported Linux distributions and says macOS and Windows use Docker Desktop with a limited feature set.
Hardware requirements: The project recommends 16 GB RAM and a 256 GB SSD for a hive, or 8 GB RAM and a 128 GB SSD for a sensor.
Data sharing: By default, data is submitted to Sicherheitstacho, and the project says this can be disabled by removing the ewsposter section from the configuration.
Security considerations: The project warns that compromise cannot be ruled out and says honeypots should not contain sensitive data.
Vulnerability reporting: The security policy asks reporters to identify the affected component, provide reproduction details, and check whether the issue is known upstream.
Support: T-Pot is provided as-is without a support commitment; users can report issues and ask general questions through GitHub Issues and Discussions.
Retention: Log persistence defaults to 30 cycles and the default Elasticsearch index policy keeps indices for 30 days; both can be adjusted.
LLM honeypots: The Beelzebub and Galah honeypots require Ollama, while ChatGPT support is described as untested with T-Pot.
Price from: Free

Where it ranks on The Geeks Club

Best Honeypot Software in 2026#6 of 18

Is T-Pot yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote T-Pot

Sources

github.com/telekom-security/tpotce· checked 4 Oct 2026
github.com/telekom-security/tpotce/security/policy· checked 4 Oct 2026