How mushorg/conpot works
Conpot is an industrial-control-system honeypot: network clients interact with simulated ICS services, and those interactions can be captured as attack-session events and sent to configured logging outputs. Its protocol emulators cover industrial and general-purpose services; shared runtime facilities include session tracking, a template-driven databus, and a virtual filesystem. The sampled code confirms event-queue logging and some protocol-specific state handling, but does not establish wiring for every listed emulator, so uncertain cross-module links are omitted.
Main entry points: log_worker.py Log worker · IEC104 IEC 104 · ftp FTP · tftp TFTP
Components 22
Protocol emulators
- Modbus
conpot/protocols/modbus - S7comm
conpot/protocols/s7comm - IEC 104
conpot/protocols/IEC104 - DNP3
conpot/protocols/dnp3 - BACnet
conpot/protocols/bacnet - EtherNet/IP
conpot/protocols/enip - GOOSE
conpot/protocols/goose - ICCP
conpot/protocols/iccp - OPC UA
conpot/protocols/opcua - IPMI
conpot/protocols/ipmi - SNMP
conpot/protocols/snmp - HTTP
conpot/protocols/http - FTP
conpot/protocols/ftp - TFTP
conpot/protocols/tftp
Shared runtime
- Session manager
conpot/core/session_manager.py
Templates and state
- Shared databus
conpot/core/databus.py - Template parsing
conpot/templates/parse.py - Virtual filesystem
conpot/core/virtual_fs.py
Event capture
- Session event queue
conpot/core/session_manager.py - Log worker
conpot/core/log_worker.py - Log destinations
conpot/core/loggers
Other components
- Network client
Connections 21
- Network client → Modbus: connects
- Network client → S7comm: connects
- Network client → IEC 104: connects
- Network client → DNP3: connects
- Network client → BACnet: connects
- Network client → EtherNet/IP: connects
- Network client → GOOSE: connects
- Network client → ICCP: connects
- Network client → OPC UA: connects
- Network client → IPMI: connects
- Network client → SNMP: connects
- Network client → HTTP: connects
- Network client → FTP: connects
- Network client → TFTP: connects
- IEC 104 → Shared databus: reads values
- Template parsing → Shared databus: initializes
- FTP → Virtual filesystem: reads and writes
- TFTP → Virtual filesystem: serves files
- Session manager → Session event queue: queues events
- Log worker → Session event queue: consumes events
- Log worker → Log destinations: dispatches events