Mesh defense
HoneyMesh
Trust-Scored Mesh DefenseDetect locally, enforce early, and share only what trust allows.
A distributed defense platform with local traps, JA4-first fingerprinting, persistent bans, secure dashboard/API, Pro-only HoneyMesh Exchange, and explicit trusted mesh participation.
Plain English
HoneyMesh detects hostile activity with traps and analytics, can drop banned traffic at kernel speed with XDP/eBPF, and optionally shares signed intelligence with trusted Pro peers.
What it teaches
- deception traps
- kernel-speed enforcement
- JA4-first fingerprinting
- trust-scored sharing
Use when
- You need Linux-side detection and enforcement
- You want local protection that keeps working without a central controller
- You want opt-in shared defense across trusted networks
What it observes
- Honeypot trap activity
- Port scans
- JA4 and legacy JA3 TLS fingerprints
- Payload entropy and pattern scores
- Active bans
Requirements
- Linux kernel 5.4+
- Root privileges for XDP and BPF maps
- Go 1.21+ if building from source
- HTTPS certificates for non-lab dashboard/API use
Manual-backed details
- Modes include TEST, ENFORCE, and LOCKDOWN.
- Shared defense is Pro-only, disabled by default, and requires explicit operator opt-in.
- Trusted peers use BTL levels L0 observe, L1 corroborated, L2 immediate enforcement, and L3 authoritative override.
Next step
Start in TEST mode, review the Live Threat Stream, then move selected interfaces and bans into ENFORCE only after allowlists and trust levels are understood.