drk1wi/Portspoof

Health v2 · maintenance only

Adoption not part of the score

2427 stars · 179 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Portspoof is a lightweight C++ tool that emulates open TCP ports and convincing service signatures across all 65535 ports, making port scanning and service fingerprinting slow and unreliable for attackers. It runs in userland, binds to a single port, and can also act as an exploitation framework frontend against attacker scanning tools.

Use cases

• hide real services from nmap scans
• make port scanning slow and costly for attackers
• confuse service version detection with fake banners
• deceive attackers during reconnaissance
• protect a server's real attack surface from enumeration

When to choose

• you want to obscure which TCP ports actually host real services
• you need a lightweight, userland deception layer without root privileges
• you want to slow down or frustrate automated reconnaissance against a host

When to avoid

• you need a full honeypot with logging and attacker interaction analysis
• you require per-service emulation of real application protocols
• your environment cannot tolerate iptables rules or altered network responses

Facets

cli-tool · maturity active

security networking simulation security networking penetration-testing cli port-scanning-defense honeypot deception service-emulation reconnaissance linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="drk1wi/Portspoof")