<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Implementing Network Deception — API & Tool Reference

> Quick reference for tools, commands, and APIs used in implementing-network-deception.

## Tools

### `opencanaryd`

Lightweight honeypot daemon

**Usage:**
```bash
opencanaryd --start
```

**Key Flags:**
  - `--start: start daemon`
  - `--status: check status`
  - `--stop: stop daemon`
  - `--copyconfig: generate default config`

---

### `nmap`

Service verification for deception assets

**Usage:**
```bash
nmap -sV -p 22,80,445,3389 <honeypot_ip>
```

**Key Flags:**
  - `-sV: service version detection`
  - `-p: port specification`
  - `-O: OS fingerprint`

---

### `canarytokens`

Token-based deception triggers

**Usage:**
```bash
curl -s https://canarytokens.org/generate -d 'type=dns&email=alert@corp.com'
```

**Key Flags:**
  - `type: token type (dns, web, pdf, aws-keys)`
  - `email: notification target`

---

## Integration Notes

- All tools should be run with least-privilege access appropriate to the task
- Log all tool invocations for audit trail
- Validate tool output before acting on results
- Cross-reference findings with multiple tools where possible

## See Also

- Parent skill: [Network Security](../../../SKILL.md)
- Technique SKILL.md: [../SKILL.md](../SKILL.md)
