What it does
Cowrie is an open-source SSH and Telnet honeypot that records sessions and related payload artifacts for defensive analysis.
Cowrie records interactions with a deliberately presented SSH or Telnet service. Its emulated-shell mode gives a responder timed session replay, saved payloads and JSON records of logins, commands and downloads. Choose the backend deliberately: proxy mode forwards to a real backend, while LLM mode uses a local or external model for shell output. Those modes change the isolation and data path. Keep the deployment separate from ordinary administrative access and define how collected files and session records will be handled.
Strengths
- Recorded sessions with replay and structured output
Best for
- Defenders researching activity against controlled decoy services
Sources
- Cowrie (Oct 26, 2026)