a honeypot means any hit is a real alert

why most alerts are noise and this one isn't

most detection setups drown you in false positives. some scanner hits your web server, your ids fires, you spend twenty minutes figuring out it was a vulnerability scanner you forgot you ran last tuesday. that's the normal state of monitoring and it's exhausting. a honeypot flips the whole equation. instead of watching traffic to a real service and trying to decide if it's malicious, you build a fake service that has zero legitimate reason to ever get touched. no real user, no real app, no scheduled job, nothing in your environment should ever connect to it. so when something does, you already know the answer. that's not "maybe suspicious." that's a real alert.

what opencanary actually is

opencanary is a free, open source honeypot daemon that impersonates common services like ssh, ftp, telnet, mysql, rdp, smb, and a bunch of others. it doesn't actually run those services. it just listens on the port, responds enough to look convincing, and logs every single connection attempt including source ip, timestamp, and whatever credentials or commands got thrown at it. it's lightweight, it runs on a raspberry pi without breaking a sweat, and it's designed for exactly this use case: cheap, low-maintenance tripwires scattered around your own network.

the entire value proposition is this: real services get real traffic and fake positives. fake services that nobody should touch get zero traffic unless someone is poking around where they shouldn't be. there's no gray area to interpret.

setting it up on your own network

this is meant for your own lab, homelab, or infrastructure you're responsible for defending, not someone else's network. the setup is simple:

pip install opencanary
sudo opencanaryd --copyconfig
sudo nano /etc/opencanaryd/opencanary.conf

that config file is where you decide which fake services to turn on. you can enable a fake telnet listener, a fake mysql port, a fake rdp endpoint, whatever makes sense for your environment. the trick is picking something that looks plausible on your network but that nothing legitimate actually uses.

then you just start the daemon:

sudo opencanaryd --start

from there it runs quietly in the background, logging to a file or forwarding to a siem if you've got one, and doing absolutely nothing unless someone connects to it.

where to put it so it actually catches something

placement matters more than the tool itself. an unused port on a random cloud vm facing the internet will catch mostly automated scanners and bots doing mass recon, which is still useful for seeing what's probing you. but the real payoff is internal placement. drop a canary on your internal network mimicking a file share, a database, or an old admin panel. if an attacker ever gets a foothold inside your network and starts doing lateral movement recon, that's exactly the kind of low, quiet scanning a canary is built to catch. real users never touch it because they have no reason to know it exists. an attacker doing discovery will hit it almost by accident, because discovery is their whole job at that stage.

what a hit actually tells you

when opencanary logs a connection, you get the source ip, which port got hit, and often the actual payload, like a login attempt with a username and password, or a command someone tried to run. that's not just "someone touched a port." that's intel. you can see what credentials they're trying, which tells you if leaked or reused passwords are in play. you can see the source, which tells you if it's internal (very bad, means something inside your network is compromised or misconfigured) or external (still bad but more expected). every hit is a lead worth chasing immediately, because there's no legitimate explanation for it existing.

the takeaway

most of security monitoring is about tuning out noise to find the signal. a honeypot skips that problem entirely by making the signal the only thing that can happen. set up opencanary on a port nothing legitimate uses, on a network you own, and treat every single hit as real. it costs you almost nothing to run and it turns "maybe something's wrong" into "something is definitely wrong, go look." that's a rare trade in this field and it's worth taking.