Turn suspicious traffic into intelligence—without exposing your real services.

Overview

NetDefender is a network defense and traffic redirection platform designed to sit at the intersection of SDN and IDS. Instead of only blocking traffic, it can selectively divert suspicious sessions into container-based honeypots to reduce risk and increase visibility.

At a high level, the SDN controller enforces policy through OVS flow rules, while Snort produces real-time alerts that can trigger re-routing decisions. This makes it useful for both protection and research.

What it includes

System requirements

Choose one deployment model:

Network architecture

The topology below illustrates how forwarding, detection, and diversion connect: OVS forwards traffic, the controller evaluates policy, and alerts from Snort can result in redirecting selected flows into honeypot containers.

Honeypot configuration (JSON)

Honeypots are declared via a JSON file. Each container definition includes an image name, a unique identifier, and one or more port mappings. Multi-instance scaling can be enabled when you expect higher traffic.

{
  "containers": [
    {
      "image_name": "cowrie/cowrie",
      "name": "ssh",
      "ports": [
        { "host_port": 22, "container_port": 2222, "protocol": "tcp" }
      ],
      "command": "",
      "multi": "yes",
      "max": 10,
      "max_containers": 10,
      "send_response": "yes"
    },
    {
      "image_name": "dinotools/dionaea",
      "name": "dionaea",
      "ports": [
        {"host_port": 21, "container_port": 21, "protocol": "tcp"},
        {"host_port": 69, "container_port": 69, "protocol": "udp"},
        {"host_port": 80, "container_port": 80, "protocol": "tcp"},
        {"host_port": 443, "container_port": 443, "protocol": "tcp"},
        {"host_port": 445, "container_port": 445, "protocol": "tcp"}
      ],
      "multi": "yes",
      "max": 10,
      "max_containers": 10,
      "send_response": "yes"
    }
  ]
}

The example above is shortened for readability on a landing page. For the full multi-port list, see the repository documentation.

Configuration parameters

Container-level fields

Port mapping fields

Honeypot types

Cowrie (SSH/Telnet)

Goal: simulate interactive SSH/Telnet to log brute-force attempts, commands, and dropper behavior.

Image: cowrie/cowrie • External port: 22 • Internal port: 2222

Dionaea (multi-service)

Goal: expose multiple emulated services to attract common scanning and exploitation attempts across protocols.

Image: dinotools/dionaea

For the complete port list used by Dionaea in this project, see the repository configuration examples.

Installation

VMware Workstation Pro (Linux Usage)

If you run this in VMware Workstation Pro, promiscuous capture may require elevated permissions:

sudo -s
chmod a+rw /dev/vmnet0

Reference: VMware documentation on promiscuous mode.

Controller host (Ryu/OSKen)

sudo -s
apt install git -y
git clone https://github.com/sinyuan1022/NetDefender.git
cd ./NetDefender/ryu/
bash ./ryu_install.sh

ovs-ofctl del-flows br0 -O OpenFlow13

IDS host (Snort)

sudo -s
apt install git -y
git clone https://github.com/sinyuan1022/NetDefender.git
cd ./NetDefender/snort/
bash ./snort_install.sh

Single-server mode (optional)

sudo -s
apt install git -y
git clone https://github.com/sinyuan1022/NetDefender.git
cd ./NetDefender/
bash ./singel.sh

Manual startup mode for multi-server deployment

For a two-server deployment, manually start the services as follows:

Ryu Server:
osken-manager ovs.py

Snort Server:
python3 pigrelay.py

Before running the commands, please navigate to the corresponding directory under ./NetDefender/.

Example:

Ryu Server:
  cd ./NetDefender/ryu
  osken-manager ovs.py

Snort Server:
  cd ./NetDefender/snort
  snort -i $INTERFACE -A unsock -l /tmp -c /etc/snort/snort.conf
  python3 pigrelay.py

For single-server deployment, the startup process is the same as the Ryu Server:
  snort -i $INTERFACE -A unsock -l /tmp -c /etc/snort/snort.conf
  cd ./NetDefender/ryu
  osken-manager ovs.py

How it operates (conceptual flow)

NetDefender’s behavior can be understood as an event loop across enforcement, detection, and action: OVS forwards traffic, Snort flags suspicious patterns, the controller evaluates policy, and the system redirects matching ports into the appropriate honeypot container—optionally scaling instances under load.

Use cases

Links

Repository: https://github.com/sinyuan1022/NetDefender

Related components: OSKen/Ryu, Open vSwitch, Snort, Cowrie, Dionaea.