Build a Network Honeypot on Raspberry Pi with OpenClaw AI Agent Monitoring

A Cowrie SSH honeypot running on a single Raspberry Pi logged 89,109 events from 2,123 unique attacking IPs across just 11 days, according to data published by ambient_node in 2025. That averages roughly 1,900 connection attempts per day, with 75.6% arriving over SSH and the rest over Telnet. A firewall would have silently dropped those connections. A honeypot records every username, password, command, and malware download attempt.

A honeypot is a deliberately vulnerable network service designed to attract attackers, log their behavior, and provide early warning of intrusion attempts without exposing real systems. The key distinction from production infrastructure is that any traffic hitting a honeypot is suspicious by definition. There is no legitimate reason for a user to connect to a service that does not serve real data.

Cowrie is the most widely used open-source SSH and Telnet honeypot. It presents a convincing fake shell to attackers, records their session commands, and logs every credential pair they try. The "root:root" combination alone was attempted 211 times in one 11-day sample, followed by "admin:admin" at 69 attempts. The password "123456" showed up in 840 login attempts.

Raspberry Pi hardware is ideal for honeypot deployment. A Pi 4 with 4 GB of RAM draws roughly 5 watts, costs a fraction of a cloud VM per year, and runs 24/7 without significant electricity overhead. It sits on your network as a quiet sensor, collecting threat data that firewalls, IDS systems, and endpoint agents cannot see because they are designed to block traffic rather than study it.

The gap in existing Raspberry Pi honeypot guides is what happens after Cowrie starts logging. Most tutorials stop at installation. The interesting work, classifying attack patterns, spotting credential-stuffing campaigns, and generating reports you can actually share with a security team, requires post-processing that raw log files do not provide.

Cowrie and OpenClaw both run comfortably on a Raspberry Pi 4 or Pi 5 with 4 GB of RAM. If you are using a 2 GB model, you will want to configure 2 GB of swap space (covered in the OpenClaw docs). A Pi Zero or first-generation Pi lacks the RAM and CPU for running both services.

Hardware checklist:

• Raspberry Pi 4 (4 GB) or Pi 5
• 16 GB or larger microSD card (USB SSD preferred for write endurance)
• Ethernet cable (Wi-Fi works but wired connections are more reliable for a sensor that runs 24/7)
• USB-C power supply rated for the Pi model

Software requirements:

• Raspberry Pi OS Lite (64-bit), flashed with the official Raspberry Pi Imager
• Python 3 with pip and venv (for Cowrie)
• Node.js 24 (for OpenClaw)
• Build tools: libssl-dev, libffi-dev, build-essential, libpython3-dev

Flash the OS using Raspberry Pi Imager and enable SSH during the imaging step. Preconfigure your hostname, username, and Wi-Fi credentials (if not using Ethernet) so the Pi is accessible on your network immediately after first boot.

After first boot, SSH into the Pi and run system updates:

sudo apt update && sudo apt upgrade -y

Install the build dependencies Cowrie needs for its Python packages:

sudo apt install -y git python3-venv python3-pip libssl-dev libffi-dev build-essential libpython3-dev

These packages let Cowrie compile native extensions for cryptographic libraries during installation.

Cowrie should run as a dedicated low-privilege user, not as root. The official Cowrie installation guide covers additional configuration options, but the steps below are sufficient for a working Pi deployment. Create a user, clone the repository, and install into a virtual environment.

sudo adduser --disabled-password cowrie
sudo su - cowrie
git clone https://github.com/cowrie/cowrie.git
cd cowrie
python3 -m venv cowrie-env
source cowrie-env/bin/activate
pip install --upgrade pip
pip install -e .

Run the initialization command to generate the default configuration and directory structure:

bin/cowrie init

Cowrie defaults to port 2222 for SSH and 2223 for Telnet. Since attackers scan port 22, you need to redirect incoming SSH traffic. The simplest method uses iptables:

sudo iptables -t nat -A PREROUTING -p tcp --dport 22 -j REDIRECT --to-port 2222

If your Pi also serves as your SSH access point, move the real SSH daemon to a non-standard port first. Edit /etc/ssh/sshd_config, change Port 22 to something like Port 2244, restart sshd, then apply the iptables rule.

Configuring fake services. Edit etc/cowrie.cfg to customize what attackers see. Key settings:

• hostname: the fake hostname displayed in the shell (pick something that looks like a production server)
• download_path: where Cowrie saves malware samples attackers try to download
• log_path: defaults to var/log/cowrie/

Cowrie ships with a fake filesystem that mimics a Debian installation. Attackers who log in see realistic directory listings, can "cat" fake files, and run commands that Cowrie intercepts and logs without executing.

Start Cowrie and verify it is listening:

bin/cowrie start
ss -tlnp | grep 2222

Within minutes of exposing port 22, you will start seeing login attempts in var/log/cowrie/cowrie.json. Each entry includes the timestamp, source IP, username, password, and any commands the attacker ran after logging in.

Store and search your honeypot reports from any device

Free 50 GB workspace with Intelligence Mode for semantic search across threat reports. No credit card, no expiration.

Sign Up Free

Raw Cowrie logs are useful but noisy. An OpenClaw agent running on the same Pi can read those logs, classify attack patterns, and produce structured threat reports.

OpenClaw requires a 64-bit OS, 1 GB of RAM, 1 core, and 500 MB of free disk space, according to the official Raspberry Pi installation docs. Since Cowrie is lightweight, a 4 GB Pi handles both services with headroom.

Install Node.js 24 (the runtime OpenClaw requires) and then OpenClaw itself:

curl -fsSL https://deb.nodesource.com/setup_24.x | sudo bash -
sudo apt install -y nodejs
curl -fsSL https://openclaw.ai/install.sh | bash
openclaw onboard --install-daemon

The onboarding wizard will ask for an API key for your chosen LLM provider. The OpenClaw docs recommend anthropic/claude-sonnet-4-6 as the primary model, but any supported provider works.

Connecting OpenClaw to Cowrie logs. The workflow connects Cowrie's JSON log output to OpenClaw's agent capabilities. Cowrie writes structured JSON to var/log/cowrie/cowrie.json, and OpenClaw agents can be configured to read files, process their contents, and produce summaries. The agent can identify patterns like:

• Credential-stuffing campaigns (the same password list tried across hundreds of IPs)
• Targeted attacks (a single IP running specific reconnaissance commands)
• Malware staging (download attempts for known exploit kits)
• Geographic clustering (attack waves from specific ASNs or regions)

You can verify both services are running:

openclaw status
sudo su - cowrie -c "cd cowrie && bin/cowrie status"

The classification step turns bulk log data into actionable intelligence. Instead of scrolling through thousands of JSON lines looking for anomalies, you get structured summaries of what happened and why it matters. For persistent storage of those summaries, the Fast.io agent workspace provides a free MCP-accessible endpoint where OpenClaw can write reports directly.

Attack classification is only useful if your team can access the reports. Storing them on a single Raspberry Pi creates a bottleneck. You need the reports searchable, version-controlled, and shareable without SSH access to the Pi.

Several options exist for getting reports off the Pi. You could push files to S3, commit them to a Git repo, or rsync to a NAS. Each requires managing credentials, writing sync scripts, and building a search layer on top.

Fast.io offers a different approach: workspaces designed for agent-generated content. The OpenClaw agent writes a report, uploads it via the Fast.io MCP server, and the file is immediately indexed by Intelligence Mode for semantic search. Your security team can then search reports by attack type, IP range, or time window using natural language queries, without touching the Pi.

The free agent tier includes 50 GB of storage, 5,000 credits per month, and 5 workspaces with no credit card required. That is more than enough for daily honeypot reports.

Why a workspace layer matters:

• Audit trail: Fast.io logs every file upload and access event. You can verify who viewed which report and when.
• Ownership transfer: An OpenClaw agent can create and populate a workspace, then transfer ownership to a security analyst. The agent retains admin access for future uploads, but the human owns the data.
• Intelligence Mode: Once files land in a workspace with Intelligence enabled, they are auto-indexed. Ask questions like "which IPs appeared in both the June 12 and June 15 reports?" and get cited answers.
• Branded shares: Generate a read-only share link for a specific report set, useful for sharing threat intelligence with partners or clients.

Local alternatives like Elasticsearch or Grafana dashboards work too, but require maintenance. The point is to get processed intelligence off the Pi and into a format your team can search without SSH access.

Running a honeypot is legal in most jurisdictions, but the details matter. In the United States, the Electronic Communications Privacy Act (ECPA) includes a service provider protection exemption that generally allows organizations to collect information on users in the context of protecting their network. In the EU, privacy requirements applies because you are collecting IP addresses, which qualify as personal data. You should document the purpose, set a retention policy, and avoid storing more data than necessary.

A honeypot is not entrapment. Entrapment requires actively encouraging someone to commit a crime they would not have otherwise committed. A honeypot passively waits for connections. However, avoid configuring your honeypot to actively lure specific individuals or offer incentives to attack.

Network isolation. Your honeypot Pi should sit on a separate VLAN or DMZ, isolated from production systems. If an attacker finds an exploit in Cowrie itself (or in the Pi's OS), network segmentation prevents lateral movement. At minimum, configure firewall rules so the Pi can reach the internet (for receiving inbound attacks and uploading reports) but cannot initiate connections to internal hosts.

Operational tips from real deployments:

• Rotate Cowrie's fake hostname periodically. Attackers share honeypot fingerprints in forums, and a stale hostname can get your honeypot blocklisted.
• Monitor disk usage. Cowrie's JSON logs and downloaded malware samples can fill a small SD card within weeks. Set up log rotation with logrotate and archive old logs to Fast.io or another remote store.
• Use a USB SSD instead of a microSD card. SD cards degrade quickly under constant write loads. A USB SSD costs $15-20 and dramatically extends the Pi's operational lifespan.
• Keep the Pi's OS and Cowrie updated. The honeypot is deliberately exposed to attackers, and an unpatched OS vulnerability could let an attacker pivot beyond the fake shell.

What a honeypot detects and what it does not. A low-interaction honeypot like Cowrie catches SSH and Telnet brute-force attacks, credential-stuffing campaigns, and automated malware delivery. It does not detect web application attacks, DNS tunneling, or lateral movement within your network. For those threats, you need complementary tools like web application firewalls, DNS monitoring, and network traffic analysis.