> ## Documentation Index
> Fetch the complete documentation index at: https://docs.panguard.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# panguard trap

> Deploy and manage honeypot deception services to detect and profile attackers.

The `trap` command deploys lightweight honeypot services that mimic real network services (SSH, HTTP, SMB, and more). When an attacker interacts with a trap, Panguard captures their tactics, generates threat intelligence, and alerts you immediately.

## Usage

```bash theme={null}
panguard trap <subcommand> [options]
```

## Subcommands

| Subcommand | Description                                         |
| ---------- | --------------------------------------------------- |
| `start`    | Start honeypot services                             |
| `stop`     | Stop all running honeypot services                  |
| `status`   | Show active traps and interaction statistics        |
| `config`   | View or modify trap configuration                   |
| `profiles` | List attacker profiles built from trap interactions |
| `intel`    | Export collected threat intelligence data           |

## Options

<ParamField path="--services" type="string">
  Comma-separated list of honeypot service types to deploy. Options include `ssh`, `http`, `smb`,
  `ftp`, `mysql`, `redis`, `rdp`.
</ParamField>

<ParamField path="--data-dir" type="string">
  Override the default directory for trap logs and intelligence data. Defaults to
  `~/.panguard/trap/`.
</ParamField>

<ParamField path="--no-cloud" type="flag">
  Keep all captured intelligence local -- do not upload to the Panguard Threat Cloud.
</ParamField>

## Examples

<CodeGroup>
  ```bash Start SSH and HTTP honeypots theme={null}
  panguard trap start --services ssh,http
  ```

  ```bash Start all default honeypots theme={null}
  panguard trap start
  ```

  ```bash Check trap status and stats theme={null}
  panguard trap status
  ```

  ```bash View attacker profiles theme={null}
  panguard trap profiles
  ```

  ```bash Export threat intelligence theme={null}
  panguard trap intel
  ```

  ```bash Offline mode (no cloud upload) theme={null}
  panguard trap start --services ssh,http --no-cloud
  ```
</CodeGroup>

## Supported Honeypot Services

| Service | Default Port | What It Mimics          |
| ------- | ------------ | ----------------------- |
| `ssh`   | 2222         | OpenSSH server          |
| `http`  | 8080         | Apache/Nginx web server |
| `smb`   | 4450         | Windows file sharing    |
| `ftp`   | 2121         | FTP server              |
| `mysql` | 3307         | MySQL database          |
| `redis` | 6380         | Redis key-value store   |
| `rdp`   | 3390         | Windows Remote Desktop  |

<Warning>
  Honeypot ports are intentionally offset from standard ports to avoid conflicts with real services.
  You can customize port mappings in the trap configuration.
</Warning>

## Related

<CardGroup cols={2}>
  <Card title="Honeypots Guide" icon="book-open" href="/guides/honeypots">
    Step-by-step guide for deploying and managing honeypots.
  </Card>

  <Card title="Trap Product Overview" icon="crosshairs" href="/products/trap/overview">
    Architecture and design of the Trap deception system.
  </Card>

  <Card title="Attacker Profiling" icon="user-secret" href="/products/trap/attacker-profiling">
    How Panguard builds attacker profiles from trap data.
  </Card>

  <Card title="panguard threat" icon="cloud" href="/cli/threat">
    Run a local Threat Cloud server for intelligence aggregation.
  </Card>
</CardGroup>