# mushorg/conpot architecture

> Architecture diagram of the GitHub repository mushorg/conpot, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/mushorg/conpot
- Repository: https://github.com/mushorg/conpot

## Overview

Conpot is an industrial-control-system honeypot: network clients interact with simulated ICS services, and those interactions can be captured as attack-session events and sent to configured logging outputs. Its protocol emulators cover industrial and general-purpose services; shared runtime facilities include session tracking, a template-driven databus, and a virtual filesystem. The sampled code confirms event-queue logging and some protocol-specific state handling, but does not establish wiring for every listed emulator, so uncertain cross-module links are omitted.

Main entry points: [`conpot/core/log_worker.py`](https://github.com/mushorg/conpot/blob/main/conpot/core/log_worker.py) (Log worker), [`conpot/protocols/IEC104`](https://github.com/mushorg/conpot/tree/main/conpot/protocols/IEC104) (IEC 104), [`conpot/protocols/ftp`](https://github.com/mushorg/conpot/tree/main/conpot/protocols/ftp) (FTP), [`conpot/protocols/tftp`](https://github.com/mushorg/conpot/tree/main/conpot/protocols/tftp) (TFTP)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_protocols["Protocol emulators"]
  node_modbus["Modbus"]
  node_s7["S7comm"]
  node_iec104["IEC 104"]
  node_dnp3["DNP3"]
  node_bacnet["BACnet"]
  node_enip["EtherNet/IP"]
  node_goose["GOOSE"]
  node_iccp["ICCP"]
  node_opcua["OPC UA"]
  node_ipmi["IPMI"]
  node_snmp["SNMP"]
  node_http["HTTP"]
  node_ftp["FTP"]
  node_tftp["TFTP"]
end

subgraph group_runtime["Shared runtime"]
  node_session_manager["Session manager<br/>[session_manager.py]"]
end

subgraph group_state["Templates and state"]
  node_databus[("Shared databus<br/>[databus.py]")]
  node_templates["Template parsing<br/>[parse.py]"]
  node_virtual_fs["Virtual filesystem<br/>[virtual_fs.py]"]
end

subgraph group_capture["Event capture"]
  node_log_queue["Session event queue<br/>[session_manager.py]"]
  node_log_worker["Log worker<br/>[log_worker.py]"]
  node_loggers["Log destinations"]
end

node_client(("Network client"))

node_client -->|"connects"| node_modbus
node_client -->|"connects"| node_s7
node_client -->|"connects"| node_iec104
node_client -->|"connects"| node_dnp3
node_client -->|"connects"| node_bacnet
node_client -->|"connects"| node_enip
node_client -->|"connects"| node_goose
node_client -->|"connects"| node_iccp
node_client -->|"connects"| node_opcua
node_client -->|"connects"| node_ipmi
node_client -->|"connects"| node_snmp
node_client -->|"connects"| node_http
node_client -->|"connects"| node_ftp
node_client -->|"connects"| node_tftp
node_iec104 -->|"reads values"| node_databus
node_templates -->|"initializes"| node_databus
node_ftp -->|"reads and writes"| node_virtual_fs
node_tftp -->|"serves files"| node_virtual_fs
node_session_manager -->|"queues events"| node_log_queue
node_log_worker -->|"consumes events"| node_log_queue
node_log_worker -->|"dispatches events"| node_loggers

click node_modbus "https://github.com/mushorg/conpot/tree/main/conpot/protocols/modbus"
click node_s7 "https://github.com/mushorg/conpot/tree/main/conpot/protocols/s7comm"
click node_iec104 "https://github.com/mushorg/conpot/tree/main/conpot/protocols/IEC104"
click node_dnp3 "https://github.com/mushorg/conpot/tree/main/conpot/protocols/dnp3"
click node_bacnet "https://github.com/mushorg/conpot/tree/main/conpot/protocols/bacnet"
click node_enip "https://github.com/mushorg/conpot/tree/main/conpot/protocols/enip"
click node_goose "https://github.com/mushorg/conpot/tree/main/conpot/protocols/goose"
click node_iccp "https://github.com/mushorg/conpot/tree/main/conpot/protocols/iccp"
click node_opcua "https://github.com/mushorg/conpot/tree/main/conpot/protocols/opcua"
click node_ipmi "https://github.com/mushorg/conpot/tree/main/conpot/protocols/ipmi"
click node_snmp "https://github.com/mushorg/conpot/tree/main/conpot/protocols/snmp"
click node_http "https://github.com/mushorg/conpot/tree/main/conpot/protocols/http"
click node_ftp "https://github.com/mushorg/conpot/tree/main/conpot/protocols/ftp"
click node_tftp "https://github.com/mushorg/conpot/tree/main/conpot/protocols/tftp"
click node_session_manager "https://github.com/mushorg/conpot/blob/main/conpot/core/session_manager.py"
click node_databus "https://github.com/mushorg/conpot/blob/main/conpot/core/databus.py"
click node_templates "https://github.com/mushorg/conpot/blob/main/conpot/templates/parse.py"
click node_virtual_fs "https://github.com/mushorg/conpot/blob/main/conpot/core/virtual_fs.py"
click node_log_queue "https://github.com/mushorg/conpot/blob/main/conpot/core/session_manager.py"
click node_log_worker "https://github.com/mushorg/conpot/blob/main/conpot/core/log_worker.py"
click node_loggers "https://github.com/mushorg/conpot/tree/main/conpot/core/loggers"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_modbus,node_s7,node_iec104,node_dnp3,node_bacnet,node_enip,node_goose,node_iccp,node_opcua,node_ipmi,node_snmp,node_http,node_ftp,node_tftp,node_client toneBlue
class node_session_manager toneAmber
class node_databus,node_templates,node_virtual_fs toneMint
class node_log_queue,node_log_worker,node_loggers toneRose
```

## Components

### Protocol emulators

- [Modbus](https://github.com/mushorg/conpot/tree/main/conpot/protocols/modbus): `conpot/protocols/modbus`
- [S7comm](https://github.com/mushorg/conpot/tree/main/conpot/protocols/s7comm): `conpot/protocols/s7comm`
- [IEC 104](https://github.com/mushorg/conpot/tree/main/conpot/protocols/IEC104): `conpot/protocols/IEC104`
- [DNP3](https://github.com/mushorg/conpot/tree/main/conpot/protocols/dnp3): `conpot/protocols/dnp3`
- [BACnet](https://github.com/mushorg/conpot/tree/main/conpot/protocols/bacnet): `conpot/protocols/bacnet`
- [EtherNet/IP](https://github.com/mushorg/conpot/tree/main/conpot/protocols/enip): `conpot/protocols/enip`
- [GOOSE](https://github.com/mushorg/conpot/tree/main/conpot/protocols/goose): `conpot/protocols/goose`
- [ICCP](https://github.com/mushorg/conpot/tree/main/conpot/protocols/iccp): `conpot/protocols/iccp`
- [OPC UA](https://github.com/mushorg/conpot/tree/main/conpot/protocols/opcua): `conpot/protocols/opcua`
- [IPMI](https://github.com/mushorg/conpot/tree/main/conpot/protocols/ipmi): `conpot/protocols/ipmi`
- [SNMP](https://github.com/mushorg/conpot/tree/main/conpot/protocols/snmp): `conpot/protocols/snmp`
- [HTTP](https://github.com/mushorg/conpot/tree/main/conpot/protocols/http): `conpot/protocols/http`
- [FTP](https://github.com/mushorg/conpot/tree/main/conpot/protocols/ftp): `conpot/protocols/ftp`
- [TFTP](https://github.com/mushorg/conpot/tree/main/conpot/protocols/tftp): `conpot/protocols/tftp`

### Shared runtime

- [Session manager](https://github.com/mushorg/conpot/blob/main/conpot/core/session_manager.py): `conpot/core/session_manager.py`

### Templates and state

- [Shared databus](https://github.com/mushorg/conpot/blob/main/conpot/core/databus.py): `conpot/core/databus.py`
- [Template parsing](https://github.com/mushorg/conpot/blob/main/conpot/templates/parse.py): `conpot/templates/parse.py`
- [Virtual filesystem](https://github.com/mushorg/conpot/blob/main/conpot/core/virtual_fs.py): `conpot/core/virtual_fs.py`

### Event capture

- [Session event queue](https://github.com/mushorg/conpot/blob/main/conpot/core/session_manager.py): `conpot/core/session_manager.py`
- [Log worker](https://github.com/mushorg/conpot/blob/main/conpot/core/log_worker.py): `conpot/core/log_worker.py`
- [Log destinations](https://github.com/mushorg/conpot/tree/main/conpot/core/loggers): `conpot/core/loggers`

### Other components

- **Network client**

## Connections

- Network client → Modbus: connects
- Network client → S7comm: connects
- Network client → IEC 104: connects
- Network client → DNP3: connects
- Network client → BACnet: connects
- Network client → EtherNet/IP: connects
- Network client → GOOSE: connects
- Network client → ICCP: connects
- Network client → OPC UA: connects
- Network client → IPMI: connects
- Network client → SNMP: connects
- Network client → HTTP: connects
- Network client → FTP: connects
- Network client → TFTP: connects
- IEC 104 → Shared databus: reads values
- Template parsing → Shared databus: initializes
- FTP → Virtual filesystem: reads and writes
- TFTP → Virtual filesystem: serves files
- Session manager → Session event queue: queues events
- Log worker → Session event queue: consumes events
- Log worker → Log destinations: dispatches events