HoneyEdge — Building a Small Passive Network Decoy with an ESP32

I started HoneyEdge with a pretty simple question:

Can a tiny ESP32 device tell you when something strange is happening inside your local network, without trying to become another firewall?

Most home and small office networks have more devices than we remember.

Computers, phones, printers, TVs, cameras, IoT devices, NAS, smart plugs... and sometimes something we forgot completely.

The idea behind HoneyEdge is not to inspect everything deeply or block traffic.

It is much simpler:

Monitor • Detect • Alert

Put a small device on the network, let it listen, expose a few believable decoy services, and alert you when something interacts with it that probably should not.

Listen first

One important direction of the project is to stay as passive as possible.

HoneyEdge observes the local network and tries to build a picture of what is around it from traffic that already exists.

For example:

From this, the device can maintain a small list of devices it has seen:

MAC / IP / vendor / first seen / last seen / trust status

The goal isn't to replace Zeek, Suricata or a proper IDS.

An ESP32 obviously has very different limits.

Instead, I am interested in finding how much useful information we can extract from a very small device sitting quietly on a normal LAN.

If a completely new device suddenly appears at 03:00, that may be interesting.

If a printer normally talks only to a few machines and suddenly starts discovering other devices, that may also be interesting.

Not automatically malicious — just something worth seeing.

Then add the decoy

Passive listening is only one side of HoneyEdge.

The second side is deception.

HoneyEdge can expose fake services representing things commonly found inside local networks.

Things like:

These aren't supposed to contain real information.

They exist because normally nobody should be trying to connect to them.

That creates a very simple signal.

If another machine on your LAN suddenly starts scanning port 22, probing a fake webcam or connecting to a fake SMB service, HoneyEdge can report it.

Instead of trying to understand every packet crossing the network, we create something interesting enough to attract unexpected activity.

Basically:

If nobody should touch the decoy, touching the decoy becomes the signal.

Why an ESP32?

Partly because I like the constraint.

It would be quite easy to put Linux on a Raspberry Pi and run existing honeypot software.

But then the project becomes another Linux computer.

I wanted something closer to an appliance.

Plug it in.

Connect Ethernet or Wi-Fi.

Forget about it until something unusual happens.

The current hardware is based around a small ESP32 board, with an optional W5500 Ethernet interface.

The enclosure is around 70 mm across and 30 mm high, powered by USB-C.

I also added a small RGB LED, optional buzzer and physical button.

The LED gives a very simple status without needing to open a dashboard.

Normal operation should stay quiet.

Something interesting happens, the device can change its indication and send an alert.

Local first, cloud optional

Another part important to me is that the device should remain useful without requiring a cloud service.

Configuration and monitoring can be done locally.

HoneyEdge can expose its local web interface and use a .local hostname, with an access-point fallback for the initial configuration.

Alerts can go to things like:

I am also building a server side for easier management of several devices, but I don't want the hardware to become useless if that server disappears.

I think security hardware should fail in the least annoying way possible.

What HoneyEdge does NOT do

This part is probably as important as the features.

HoneyEdge is not designed to automatically block an attacker.

It isn't an inline firewall.

It isn't trying to replace a professional IDS.

And seeing an unusual event does not automatically mean you have been hacked.

The device is more like an alarm sensor for the network.

A smoke detector doesn't extinguish the fire.

It tells you that something deserves your attention.

That's the philosophy I'm trying to keep.

Passive monitoring is becoming the interesting part

Originally I was mostly thinking about HoneyEdge as a small honeypot.

But while developing it, I started finding the passive side more interesting.

A lot can be learned without actively scanning the network.

DHCP already tells you about devices joining.

ARP tells you a lot about IPv4 neighbors.

mDNS and SSDP reveal services devices voluntarily announce.

IPv6 Neighbor Discovery gives another view of the network.

The challenge now is deciding what information is actually useful instead of collecting everything possible.

The ESP32 limitation becomes useful here.

It forces me to ask:

Does this information really help detect something strange?

If not, maybe we don't need it.

Where I want to take it next

A few things I'm experimenting with now:

I'm also looking at ideas from tools like Zeek, but trying to reduce them to concepts that make sense on a microcontroller.

Not "put Zeek on an ESP32."

More like:

What are the smallest pieces of network behaviour that give us the biggest security signal?

That is probably the most interesting technical question in the project now.

Building in public

HoneyEdge is still evolving.

Some ideas work well, some get removed, and sometimes one experiment completely changes the direction of the project.

That's also why I'm publishing it here.

I would really like feedback from people working with ESP32, networking, honeypots, IDS systems or embedded security.

Especially about the passive monitoring side.

If you had one tiny device silently listening to your LAN, what are the first behaviours you would want it to detect?

That's probably what I'll be experimenting with next.

HoneyEdge — Monitor • Detect • Alert