Detect network scanners
Scanners don’t knock politely. They sweep ports looking for weak SSH, open RDP, lonely databases, and forgotten admin panels.
What scanning looks like
Short connections across many ports. Failed logins. Protocol banners grabbed and discarded. On a quiet home LAN, that pattern is the tell.
Why you miss it
Firewalls may drop traffic silently. Consumer routers rarely show rich histories. Without a decoy, “nothing broke” is mistaken for “nothing tried.”
Make the knock obvious
HoneyBox presents services attackers expect. Each attempt becomes a log line on your SD card — timestamps, protocols, evidence you can keep. Optional email alerts shorten the time between knock and notice.