path: root/extensions/
diff options
Diffstat (limited to 'extensions/')
1 files changed, 34 insertions, 0 deletions
diff --git a/extensions/ b/extensions/
new file mode 100644
index 0000000..26526b7
--- /dev/null
+++ b/extensions/
@@ -0,0 +1,34 @@
+Captures and holds incoming TCP connections using no local
+per-connection resources. Connections are accepted, but immediately
+switched to the persist state (0 byte window), in which the remote
+side stops sending data and asks to continue every 60-240 seconds.
+Attempts to close the connection are ignored, forcing the remote side
+to time out the connection in 12-24 minutes.
+This offers similar functionality to LaBrea
+<> but doesn't require dedicated
+hardware or IPs. Any TCP port that you would normally DROP or REJECT
+can instead become a tarpit.
+To tarpit connections to TCP port 80 destined for the current machine:
+iptables -A INPUT -p tcp -m tcp --dport 80 -j TARPIT
+To significantly slow down Code Red/Nimda-style scans of unused address
+space, forward unused ip addresses to a Linux box not acting as a router
+(e.g. "ip route" on a Cisco), enable IP
+forwarding on the Linux box, and add:
+iptables -A FORWARD -p tcp -j TARPIT
+iptables -A FORWARD -j DROP
+If you use the conntrack module while you are using TARPIT, you should
+also use the NOTRACK target, or the kernel will unnecessarily allocate
+resources for each TARPITted connection. To TARPIT incoming
+connections to the standard IRC port while using conntrack, you could:
+iptables -t raw -A PREROUTING -p tcp --dport 6667 -j NOTRACK
+iptables -A INPUT -p tcp --dport 6667 -j TARPIT