Heralding vs TANNER

Heralding is a free, self-hosted network honeypot that collects credentials. It runs on Linux and supports FTP, Telnet, SSH, HTTP, HTTPS, POP3, POP3S, IMAP, IMAPS, SMTP, VNC, PostgreSQL and SOCKS5. When a protocol makes them available, its authentication log records usernames and plaintext passwords. It also writes authentication attempts, session summaries and full session data to CSV and JSON Lines files. Session details can include timestamps, duration, source and destination IP addresses and ports, protocol, authentication attempts and protocol-specific auxiliary data. Session log entries are written after sessions end; authentication entries appear once a password has been transmitted. The README describes pip installation on Debian-based systems and Docker deployment using port mapping. Python 3.7.0 or higher is required. For separate packet captures per session, the README points to Curisoum and says it must be enabled in Heralding.yml. GitHub identifies the project as GPL-3.0 licensed.

TANNER has no write-up on Specifiction yet; its figures are above.