A TLS Handshake on My Honeypot’s Management Port
Suricata flagged a completed TLS handshake against port 64297 on my honeypot, the port where T-Pot’s own web dashboard listens. I could not establish intent, so I marked it inconclusive. The firmer finding was about my own setup: the dashboard should not have been reachable from the internet.
Triage summary
Inconclusive- Disposition
- Inconclusive: possible honeypot fingerprinting
- Detected by
- Suricata
- Source
- Host on M247 (AS9009)
- Target
- 64297/TCP (T-Pot web dashboard)
- Finding
- Management port reachable from the internet
Evidence
- ▸A complete TLS handshake, not just a SYN, to 64297/TCP from a host on M247 (AS9009), a provider widely used for VPNs and scanning.
- ▸No exploitation attempt followed. The exchange ended after the handshake and certificate.
- ▸Because the handshake completed, the dashboard was answering the open internet. I had not restricted T-Pot’s management ports (above 64000) to an allowlist, which T-Pot’s own documentation recommends.
Assessment
64297 is specific to T-Pot, so a completed handshake there is consistent with honeypot fingerprinting: confirming what a box is before deciding whether it is worth real effort. A full-range port sweep would also reach 64297, though, so the port alone does not prove intent.
What would settle it
Whether the same source touched other ports in the same window. A broad sweep points to a generic scanner; a lone hit on 64297 points to fingerprinting.
Recommendations
Restrict the management ports to a trusted-IP allowlist or a VPN so the dashboard does not answer arbitrary hosts, and review what its default TLS certificate reveals about the box.