CanaryTCPpy is a project inspired by "Canarytokens" that can handle and trigger alerts when scanned by tools like Nmap, Masscan, etc. It utilizes the basic RFC of TCP to create a deception mechanism. By blocking the RST TCP flag, the scanner and hacker remain unaware that the services are fake or the ports are closed.
How CanaryTCPpy can help you:
- Set it up on your WAN (Wide Area Network) and trigger alerts to detect and investigate potential network intrusions.
- Monitor your network for any suspicious activity by identifying small Docker containers or Linux instances that may indicate attempts to "jump" to other servers.
- And more! Combine CanaryTCPpy with other security tools to build an active monitoring system, such as an Intrusion Detection System (IDS).
Here's an example picture tcp 3 handshake flow:
Here's an example picture showcasing the network area:
When an attacker scans a system running CanaryTCPpy with Nmap, the fake port is typically marked as yellow, indicating that it appears closed or filtered [you test by any nmap online or local]:
To run the project, follow these steps:
- Clone the repository to your local machine.
- Install Scapy, preferably using package managers like apt or yum.
- Run the provided examples in the code.
- run as sudo or root