📡 Honey SNMP Network Device

An emulated router or switch that answers SNMP and logs every query.

→ Explore in ATT&CK matrix (2 mappings) Deployment detail

What it is

Run an SNMP responder that looks like a real network device (plausible system description, interfaces and MIB data) on an internal address. Attackers collecting network-device configuration query every SNMP endpoint they find, with common or harvested community strings. Every GET or SET against the decoy is logged, and a unique community string seeded only in decoy backups identifies where it was stolen from.

Implementation requirements

An SNMP honeypot service (a commercial one such as Trapster's, or an emulator) presenting a plausible vendor system description
A unique community string seeded only in decoy configuration backups or scripts
Log every request with source IP, community string, OIDs and SNMP version
Deploy internally: on internet-facing addresses SNMP is scanned constantly and the events are low-fidelity noise
Safety: the responder exposes no real configuration and applies no SET
Rollback: Stop the responder and release its address.
Upkeep: Keep device descriptions and MIB data in line with real devices. Monthly proof-of-life query.

Cost

Low. A small VM or container.

Indicative only. Cloud pricing and licensing change — check the provider's official pricing pages for current rates before you budget.

Technologies

Network

ATT&CK coverage 2

Technique	Tactic	Status	Confidence	Tier
T1602 Data from Configuration Repository	Collection	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) SNMP detection service — Trapster documentation — A commercial SNMP honeypot service logs SNMP GET and SET requests with source IP, community string, OIDs and SNMP version. Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK (companion data) — Rates T1602 as highly feasible with a honey network device. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1602 Data from Configuration Repository as an adversary behaviour. The vendor notes SNMP generates high volumes of low-fidelity events; deploy internally.
T1602.001 SNMP (MIB Dump)	Collection	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) SNMP detection service — Trapster documentation — Logs every SNMP GET and SET request against the honeypot. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1602.001 SNMP (MIB Dump) as an adversary behaviour.

Evidence

Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK (companion data) — Valeros, V.; Catania, C.; Lisý, V.; Griffioen, H., Stratosphere Laboratory, Czech Technical University in Prague 2026 preprint
SNMP detection service — Trapster documentation — Trapster industry
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard

Research basis: Commercial SNMP honeypot services log GET and SET requests with the community string used (Trapster). Collecting device configuration over SNMP is documented attacker behaviour (ATT&CK T1602.001). Valeros et al. (2026) rate T1602 as highly feasible with a honey network device.