Honeytrap vs TANNER

Honeytrap is a free, open-source system for running, monitoring, and managing honeypots on Linux in a self-hosted deployment. It can combine multiple services into one honeypot and supports interaction levels from low to high, including upgrades to higher-interaction handling. Agents download configuration from a Honeytrap Server, which can manage many agents and centralize logging. Agents can also redirect traffic between networks. Payload detection routes requests to a service and allows one port to handle multiple protocols. A Sensor listener can complete a TCP handshake and store payloads to monitor lateral movement within a network. LXC or remote-host directors can create high-interaction honeypots by proxying traffic and extracting information. Honeytrap can extend existing honeypots such as Cowrie or Glutton with its listening and logging framework. Logging supports filtering and destinations including Elasticsearch, Kafka, Splunk, Raven, files, and the console. The code is released under Apache License 2.0, and the project points users to a mailing list for discussion. The GitHub releases page states that the repository has no releases.

TANNER has no write-up on Specifiction yet; its figures are above.