Source IP from binary uploaders

[domingo13]

Is there a way to get the source ip of the clients uploading binaries into dionaea?

I can see a lot of uploads but I haven't found a way to correlated those binaries to an actual source ip. dionaea.json contains a lot of activity but most of them are just port scanners.

[EvilWatermelon]

I can not find a direct solution but if you only use Dionaea then maybe using Suricata can help. This shows all src IPs. I have the same problem and this is the only solution I have right now.
This happens in version 22.04 as well as in 24.04. Maybe a problem with your firewall? I have allowed all necessary Ports (TCP and UDP) with UFW and I can only see the source IPs in Honeytrap and Suricata. So yeah these are the only proposes I can give you.

[EvilWatermelon]

#1199 look here. Maybe this helps.

[domingo13]

Thanks for the effort.
I have a lot of connections, so it not that trivial to correlate on that alone.

[EvilWatermelon]

I think that the focus of Dionaea is more on catching Malware binaries and less network traffic.