Decoy · Device
Managed switch decoy
Whoever controls the network gear can see and redirect traffic. This decoy poses as core-sw01, a Cisco Catalyst-style switch with Telnet, SSH, a web admin page, SNMP and NTP.
What it emulates
Poses as: Managed switch or router.
Network engineers know which switches are real. A login attempt on one that nobody manages is a clear signal.
- Telnet 23
Shows the Cisco "User Access Verification" prompt, records every username and password, then refuses.
- SSH 22
Presents a Cisco SSH server. Records every username and password, then refuses.
- HTTP 80
A web admin that asks for a password in the browser pop-up, the way Cisco gear does. Records every attempt.
- SNMP 161/udp
Answers basic SNMP read queries and records the community string, which works like a password. Replies are capped per address so it cannot be used to flood anyone. It reports itself as a Cisco IOS switch, with a version that differs per decoy.
- NTP 123/udp
Records time queries, including the "monlist" probe used for amplification attacks. Never replies, so it cannot be used to amplify anything.
What it catches
Every touch, explained in plain English.
Each event gets a plain-English explanation. Related events from the same source become one incident with a recommended action.
- Logins to the switch over Telnet, SSH and the web
- SNMP queries with guessed community strings
- NTP amplification probes
- Port scans across the management network
MITRE ATT&CK
Techniques come from a fixed table, not from AI, so the same activity always maps the same way.
- T1046Network Service Discovery
- T1059Command and Scripting Interpreter
- T1110Brute Force
Incidents go to email, Slack, your SIEM or a signed webhook. Kandaro and your SOC
Safe by design
Built to be attacked. Never a way in.
A decoy only listens and answers with fake data. It never runs code and only connects out to Kandaro, so it can never become a way into your network.
It runs nothing
The sensor has no way to run a command, load code or update itself. Every command an intruder types gets a fake text answer.
It connects to one place only
Its only outbound connection is HTTPS to the Kandaro API address set at install time. Nothing Kandaro sends can change that address.
Kandaro can only send it settings
Which decoy to imitate, which services to turn off, which addresses to ignore. There is no field for code, files, commands or updates.
It holds no real secrets
Passwords, keys and records it shows are fake. Its only credential is its own key, which can send events for your organisation and nothing more.
It cannot be used to attack others
It never forwards traffic, never fetches a URL and never serves scripts or programs. Its only UDP replies (SNMP) are rate-limited per address.
Non-root, read-only container with signed images. How we secure sensors
Where to put it
Place it where an intruder will look.
Put it in your management VLAN, next to the real switches and routers.
Installs in about a minute with Docker, Kubernetes, Ansible, a VM or a Raspberry Pi, and needs outbound HTTPS only. Deployment guide · Where to put your first decoys
FAQ
Managed switch decoy questions
Can an attacker actually log in?
Does it route or switch any traffic?
Is it safe to run on my network?
Related decoys
Pair it with these.
- device
FortiGate firewall
Fortinet FortiGate firewall
A FortiGate management page that catches login attempts and known exploit probes.
HTTPS admin 443HTTP admin 80SSH 22Telnet 23SNMP 161/udp - device
Network printer
Office network printer
Blends into any office network. Nobody logs into a printer by accident.
HTTP 80JetDirect 9100TFTP 69/udpLPD 515IPP 631+3 - device
IP camera
IP camera (BusyBox)
A favourite of botnets and curious insiders: web login, RTSP video and Telnet.
HTTP 80RTSP 554Telnet 23Camera SDK 8000SIP 5060/udp
Put this decoy on your network today.
Start a 14-day trial of Kandaro Deception. Your first decoy is running in about a minute.
Card required · cancel before day 14 and pay nothing