Show HN: Spip – Open-Source Self-Hosted TCP Network Sensor

Posted by Robbedoes on Friday February 06, 2026 @04:25AM
from the show-hn dept.

https://github.com/StefanGrimminck/Spip-Go

Spip is a lightweight, low-interaction network honeypot sensor. It listens for arbitrary incoming TCP traffic (plain and TLS), captures what scanners and bots send, and logs each connection as structured JSON (ECS-shaped) for easy ingestion into your SIEM or data lake.

( 2 comments | 3 points | on HN )

Re:Show HN: Spip – Open-Source Self-Hosted TCP Network Sensor by RockSteadyCrew on Friday February 06, 2026 @04:37AM (#46910827)

I wonder if you could move to pure-Go with x/sys/unix to retrieve SO_ORIGINAL_DST instead of leveraging Cgo? It would make cross-compilation for different architectures a lot easier. What kind of sensor results are you seeing with the default setup?

[ Parent | on HN ]

Re:Show HN: Spip – Open-Source Self-Hosted TCP Network Sensor by Robbedoes on Friday February 06, 2026 @04:47AM (#46910892)

Good suggestion. To be honest, Cgo was the easiest for me to implement, as I originally wrote the tool in a different language. Also, most of the documentation for Netfilter and SO_ORIGINAL_DST is in C.

As for results: I’m seeing about one 'hit' per second on a standard VPS. It's a constant stream of bots looking for exploitable systems and probes from scanners like Shodan and Censys. It’s actually surprising how quickly a new IP gets picked up by these crawlers.

[ Parent | on HN ]