Glutton review
A focused Linux honeypot for capturing and routing broad network traffic.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Glutton is an open-source, self-hosted network honeypot written in Go for security teams that need broad TCP and UDP traffic capture. It accepts activity across ports, applies configurable routing rules, and sends interactions to protocol-specific handlers or generic TCP and UDP fallbacks. Its network-focused decoy scope makes it a fit for teams monitoring unsolicited connections and preserving useful payloads when the protocol is not recognized.
Glutton’s standout capability is its catch-all capture model. It includes handlers for HTTP, SMTP, RDP, SMB, FTP, MQTT, MongoDB and Telnet, while Spicy-based HTTP parsing supports protocol detection and structured handling. Selected connections can be forwarded through a TCP proxy to upstream targets, giving teams a way to route interactions instead of treating every connection as an isolated capture. JSON process logging with rotation supports operational review, and optional HTTP or hpfeeds event producers extend how captured activity can leave the honeypot.
The project is best suited to teams comfortable operating Linux software themselves and tailoring routing, handlers and logging to their monitoring workflow. Its MIT-licensed open-source model avoids a commercial-plan structure, but the trade-off is a narrower platform and ecosystem footprint: deployment is self-hosted on Linux, with event output centered on HTTP and hpfeeds. Choose Glutton when protocol breadth, generic traffic handling and direct control matter most. Choose an alternative when you need hosted deployment, broader platform support or a larger set of ready-made integrations.
Glutton pros and cons
- Where it wins
- Captures TCP and UDP traffic across ports with generic fallbacks
- Supports handlers for HTTP, SMTP, RDP, SMB, FTP, MQTT and more
- Provides JSON logs, rotation, proxy forwarding and optional event output
- Where it doesn't
- Self-hosted deployment requires Linux infrastructure
- Platform coverage is limited to Linux
- Integration options are limited to HTTP and hpfeeds event output
Glutton fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update