Last thing we want to do is provoke an attacker and offer them challenges or puzzles indirectly to give them a flag to stay and continue to hack rather than move on to other hosts. If possible, I do not wish to let the attackers know that my iptables rules have TARPIT enabled for certain ports.

If I do not know that TARPIT is enabled, in most cases, as a user, it just feels sluggish or unresponsive and after a while, I'd imagine I'd just give up because the server is probably running slow or has a very slow hardware. I think last time I've tried to nmap on my TARPIT enabled host, it just reported that port was open, but did not slow it down, so from the attacker's point of view, it's business as usual.

Although it is more for the sake of concerns, from academic point of view, I am also curious to know if the endpoint has TARPIT enabled or not, and what one can do to make it less obvious.

  • TARPIT isn't a good idea since it allows an attacker to use all your server's resources (file handles in this case) and do a denial of service attack on it. – user42178 Sep 21 '14 at 17:57
  • No serious attacker is interested in "challenges and puzzles" nowadays. The black hat community has matured far beyond that. The only thing black hat hackers are interested in is your data (for selling it on the black market) and your hardware power (for turning your server into a botnet zombie). Whether or not they move to other hosts or not depends solely on how much effort you seem to be worth. – Philipp Sep 21 '14 at 22:30

According to http://www.netfilter.org/projects/patch-o-matic/pom-external.html "Connections are accepted, but immediately switched to the persist state (0 byte window)...".

Since the window is send to the peer in the TCP packet a knowledgeable attacker might deduce from a packet dump that your system is either permanently overloaded because all connections stall immediately or that it is running some kind of tarpit, in which case the attacker might probably easily find out which ports are not protected by the tarpit. Most script kiddies instead will probably do not understand what's going on and just give up.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.