Self-host Knock-Knock
v3.0.0Multi-protocol honeypot with live attack dashboard
- Stars
- 214
- Ports
- 8080 (web dashboard), 22 (SSH honeypot), 21 (FTP honeypot), 23 (Telnet honeypot), 25 (SMTP honeypot), 80 (HTTP honeypot), 445 (SMB honeypot), 587 (SMTP submission honeypot), 3389 (RDP honeypot), 5060 (SIP honeypot (TCP/UDP))
- Requires
- MaxMind GeoIP databases (GeoLite2-ASN, GeoLite2-City), Redis
ghcr.io/djkurlander/knock-knock
What is Knock-Knock?
This project is a honeypot platform that simulates vulnerable network services to attract and study automated attack traffic. It emulates common protocols like SSH, FTP, remote desktop, mail, and voice services, then presents the captured intrusion attempts in a browser-based dashboard with live maps, ranked lists of usernames and passwords, and geographic breakdowns. The system uses MaxMind geolocation to enrich each connection attempt, stores data in SQLite with Redis for real-time updates, and exposes a FastAPI web interface. It can aggregate feeds from multiple sensors into one view and publishes a blocklist of offending addresses that works with popular firewall tools. Deployment options include containerized setups with Docker Compose or traditional service units on major Linux distributions. A server with a public address and root privileges is needed, and the real SSH daemon must be relocated off the standard port.
Should you self-host Knock-Knock?
Knock-Knock scores 48/100 on selfhost.directory (how scoring works) and ranks #49 of 78 in Security. It has 214 GitHub stars.
It shipped 5 stable releases in the past year. The latest, v3.0.0, came out on 26 July 2026. New versions land roughly every 5 weeks.
Setup is advanced: plan for several services and some ongoing maintenance. An official Docker image is available. It is MIT-licensed and written mostly in Python.
Its closest alternative on selfhost.directory is pentagi (83/100, 32 653 stars). It scores higher overall, so compare the two before you pick. See Knock-Knock vs pentagi side by side.
Features
- 3D globe visualizations
- Attack trivia
- Auto-ban repeat offenders
- Credential leaderboards
- Extensible protocol framework
- Geographic attack analysis
- HTTPS Support
- IP blocklist feed
- Knock-knock jokes
- Live attack feed
- Multi-protocol honeypot
- Multi-server aggregation
- Protocol statistics
- Self IP redaction
- Visitor logging
Knock-Knock README
More in Network Security
konarrKonarr is a self-hosted, open-source SCA platform for monitoring container dependencies and vulnerabilities using Syft, Grype, and Trivy.
KrawlKrawl is a self-hosted web honeypot with AI-generated deception pages to detect and track malicious crawlers. Features a real-time dashboard and firewall integration.
mCaptchaSelf-hosted, open-source CAPTCHA server where visitors' browsers do SHA256 proof-of-work instead of image puzzles; the Rust backend runs with Postgres and Redis.
meridianMeridian is an open-source CLI that deploys censorship-resistant VLESS+Reality, XHTTP, and Hysteria2 proxy servers on your VPS with automatic hardening.
NetAlertXSelf-hosted, open-source network monitoring tool that discovers devices via ARP, SNMP, Nmap and router imports, then alerts you on every change.
netbirdNetBird is a self-hosted, open-source zero-trust networking platform with WireGuard mesh, centralized access control, SSO/MFA, and posture checks.
netgoatNetGoat is an open-source, self-hosted Go reverse proxy and free Cloudflare alternative with domain routing, WAF rules, rate limiting, TLS/ACME and bot challenges.
nftables blacklistnftables-blacklist is a self-hosted, open-source bash script that downloads IP blacklists and blocks them via nftables on Linux servers with IPv4/IPv6 support.
ntopngSelf-hosted, open-source (GPLv3) network traffic monitor: live flows, top talkers, nDPI layer-7 detection, NetFlow/sFlow collection and a REST API.
openvpnOpenVPN is an open-source, self-hosted VPN daemon for remote access and site-to-site tunnels, offering PKI auth, NAT traversal, TUN/TAP devices, and post-quantum TLS.
OpenZitiOpenZiti is an open-source, self-hosted zero-trust overlay network: identity-based access, dark services with no open ports, tunnelers and SDKs instead of VPN.
opnsenseSelf-hosted, open-source firewall and routing platform on FreeBSD: stateful filtering, VPN, Suricata IPS, multi-WAN failover, all managed from a web GUI.
0 comments